samba - Jan 2024 - Behavior of acl_xattr:ignore system acls = yes on a share

On 1/30/24 16:27, Rowland Penny via samba wrote:
> On Tue, 30 Jan 2024 16:13:41 +0100
> Peter Milesson via samba <samba at lists.samba.org> wrote:
> 
>> Hi folks,
>>
>> It seems that the setting acl_xattr:ignore system acls = yes reduces
>> Windows compatibility when defined for a share. In all attempts I
>> have used Windows tools (except editing smb.conf)
> 
> Lets walk through the relevant part of that parameter:
> 'ignore system acls'
> 
> It does what it says, with it set, Samba totally ignores the Unix acls
> you can see with 'ls' and getfacl. You must set the permissions
from
> Windows and either read them from Windows or with tools such as
> 'samba-tool ntacl get'.
...and you must start with a clean state, iow a share basedirectory that 
doesn't have any POSIX ACEs, just root:Domain Users 0777 or similar. 
"ignore systems acls" only implies Samba will not attempt itself to
map
the NT ACL to a POSIX ACL and apply in on disk. It doesn't apply that 
existing POSIX ACLs will be enforced by the kernel and inheritted by the 
kernel if applicable.

Cheers!
-slow

-- 
SerNet Samba Team Lead       https://samba.plus/
Samba Team Member             https://samba.org/
SAMBA+ packages              https://samba.plus/
SerNet Samba Support, Consulting and Development


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20240130/1a2465e1/OpenPGP_signature.sig>

On 30.01.2024 16:51, Ralph Boehme via samba wrote:
> On 1/30/24 16:27, Rowland Penny via samba wrote:
>> On Tue, 30 Jan 2024 16:13:41 +0100
>> Peter Milesson via samba <samba at lists.samba.org> wrote:
>>
>>> Hi folks,
>>>
>>> It seems that the setting acl_xattr:ignore system acls = yes
reduces
>>> Windows compatibility when defined for a share. In all attempts I
>>> have used Windows tools (except editing smb.conf)
>>
>> Lets walk through the relevant part of that parameter:
>> 'ignore system acls'
>>
>> It does what it says, with it set, Samba totally ignores the Unix acls
>> you can see with 'ls' and getfacl. You must set the permissions
from
>> Windows and either read them from Windows or with tools such as
>> 'samba-tool ntacl get'.
>
> ...and you must start with a clean state, iow a share basedirectory 
> that doesn't have any POSIX ACEs, just root:Domain Users 0777 or 
> similar. "ignore systems acls" only implies Samba will not
attempt
> itself to map the NT ACL to a POSIX ACL and apply in on disk. It 
> doesn't apply that existing POSIX ACLs will be enforced by the kernel 
> and inheritted by the kernel if applicable.
>
> Cheers!
> -slow
>
Hi Ralph,

I will start again with a clean folder and see what happens.

Best regards,

Peter

On 30.01.2024 16:51, Ralph Boehme via samba wrote:
> On 1/30/24 16:27, Rowland Penny via samba wrote:
>> On Tue, 30 Jan 2024 16:13:41 +0100
>> Peter Milesson via samba <samba at lists.samba.org> wrote:
>>
>>> Hi folks,
>>>
>>> It seems that the setting acl_xattr:ignore system acls = yes
reduces
>>> Windows compatibility when defined for a share. In all attempts I
>>> have used Windows tools (except editing smb.conf)
>>
>> Lets walk through the relevant part of that parameter:
>> 'ignore system acls'
>>
>> It does what it says, with it set, Samba totally ignores the Unix acls
>> you can see with 'ls' and getfacl. You must set the permissions
from
>> Windows and either read them from Windows or with tools such as
>> 'samba-tool ntacl get'.
>
> ...and you must start with a clean state, iow a share basedirectory 
> that doesn't have any POSIX ACEs, just root:Domain Users 0777 or 
> similar. "ignore systems acls" only implies Samba will not
attempt
> itself to map the NT ACL to a POSIX ACL and apply in on disk. It 
> doesn't apply that existing POSIX ACLs will be enforced by the kernel 
> and inheritted by the kernel if applicable.
>
> Cheers!
> -slow
>
>
Hi folks,

I setup a new share and tried to configure it.

*Setup shared folder*

  * Create the folder /data/migrtest
  * Set ownership to root:"Domain Admins"
  * chmod 0770 migrtest


*smb.conf*

[Migrtest]

    path = /data/migrtest
    read only = no
    acl_xattr:ignore system acls = yes

Then smbcontrol smbd reload-config and smbcontrol winbind reload-config

*Windows Computer Management*

  * Starting Computer Management as Administrator
  * Connecting to the server
  * Selecting Shares and Properties of the share Migrtest


*Tab Security*
Owner: Administrator at private.talps

-Permissions list-
root (Unix User\root)??? Full Control??? This folder only
Domain Admins (Private\Domain Admins)??? Read, write & Execute??? This 
folder only
SYSTEM??? Full control??? This folder only

If I click on OK, no complaints. But the share is not accessible by any 
users, except for a Domain Admin user. Further, it is not possible to 
change share permissions, e.g. add any users or groups. No error 
message, but the changes will not persist

Trying to change the permissions above to something more normal:

  * disable inheritance
  * remove root
  * change access for Domain Adminst to Full control and This folder,
    subfolders and files
  * change SYSTEM to Full Control and This, folder, subfolders and files
  * add testgroup Read & Execute and This folder, subfolders and files

When clicking OK, the error message below pops up:

    An error occurred while applying security information to:

    \\linuxdev\Migrtest

    "Failed to enumerate objects in the container. Access is denied"


Setting up the share initially without acl_xattr:ignore system acls = 
yes, and turning on acl_xattr:ignore system acls = yes? after defining 
access permissions under the security tab seems to work.

Best regards,

Peter