samba - Jan 2024 - Behavior of acl_xattr:ignore system acls = yes on a share

On 31.01.2024 10:09, Ralph Boehme via samba wrote:
> On 1/31/24 09:50, Peter Milesson via samba wrote:
>> The crucial problem here is, that Everyone (yes, really everyone) can 
>> write to the root share. 
>
> why don't you just change it? That's how it's supposed to work.
>
> -slow
>
Hi Ralph,

Unfortunately, that doesn't work. In share permissions, it's not 
possible to remove Everyone, nor add another security object. Clicking 
OK, the dialog closes without any errors, but opening it again, Everyone 
is still there. I was sure to start Computer Management as Administrator.

If it would be possible to set share permissions, then it would be usable.

Best regards,

Peter

On Wed, 31 Jan 2024 11:38:31 +0100
Peter Milesson via samba <samba at lists.samba.org> wrote:
> 
> 
> On 31.01.2024 10:09, Ralph Boehme via samba wrote:
> > On 1/31/24 09:50, Peter Milesson via samba wrote:
> >> The crucial problem here is, that Everyone (yes, really everyone)
> >> can write to the root share. 
> >
> > why don't you just change it? That's how it's supposed to
work.
> >
> > -slow
> >
> Hi Ralph,
> 
> Unfortunately, that doesn't work. In share permissions,
Sorry, but you should only modify the 'Security' tab, for which a
better name would be 'NTFS permissions'
However, as I have found, you can remove 'EVERYONE' from the Security
tab permissions, but it doesn't remove it from the permissions set on
the actual share directory.

Rowland
> it's not 
> possible to remove Everyone, nor add another security object.
> Clicking OK, the dialog closes without any errors, but opening it
> again, Everyone is still there. I was sure to start Computer
> Management as Administrator.
> 
> If it would be possible to set share permissions, then it would be
> usable.
> 
> Best regards,
> 
> Peter
> 
>

On 1/31/24 11:38, Peter Milesson via samba wrote:
> Unfortunately, that doesn't work. In share permissions, it's not 
> possible to remove Everyone, nor add another security object. Clicking 
> OK, the dialog closes without any errors, but opening it again, Everyone 
> is still there. I was sure to start Computer Management as Administrator.
are we talking share permissions or filesystem permissions? They are two 
things...

Have you granted SE_DISK_OPERATOR_PRIVILEGE which is needed iirc to 
change share permissions?

-slow

-- 
SerNet Samba Team Lead       https://samba.plus/
Samba Team Member             https://samba.org/
SAMBA+ packages              https://samba.plus/
SerNet Samba Support, Consulting and Development


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20240131/e0c8d041/OpenPGP_signature.sig>