samba - Jan 2024 - Behavior of acl_xattr:ignore system acls = yes on a share

On 1/31/24 11:38, Peter Milesson via samba wrote:
> Unfortunately, that doesn't work. In share permissions, it's not 
> possible to remove Everyone, nor add another security object. Clicking 
> OK, the dialog closes without any errors, but opening it again, Everyone 
> is still there. I was sure to start Computer Management as Administrator.
are we talking share permissions or filesystem permissions? They are two 
things...

Have you granted SE_DISK_OPERATOR_PRIVILEGE which is needed iirc to 
change share permissions?

-slow

-- 
SerNet Samba Team Lead       https://samba.plus/
Samba Team Member             https://samba.org/
SAMBA+ packages              https://samba.plus/
SerNet Samba Support, Consulting and Development


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20240131/e0c8d041/OpenPGP_signature.sig>

On Wed, 31 Jan 2024 11:56:47 +0100
Ralph Boehme via samba <samba at lists.samba.org> wrote:
> On 1/31/24 11:38, Peter Milesson via samba wrote:
> > Unfortunately, that doesn't work. In share permissions, it's
not
> > possible to remove Everyone, nor add another security object.
> > Clicking OK, the dialog closes without any errors, but opening it
> > again, Everyone is still there. I was sure to start Computer
> > Management as Administrator.
> 
> are we talking share permissions or filesystem permissions? They are
> two things...
From my perspective, I am talking filesystem permissions, the things
you change through the 'Security' tab in 'Properties', I never
touch
the 'share' tab, it doesn't seem to do anything.
> 
> Have you granted SE_DISK_OPERATOR_PRIVILEGE which is needed iirc to 
> change share permissions?
In my case yes.

Rowland

On 31.01.2024 11:56, Ralph Boehme via samba wrote:
> On 1/31/24 11:38, Peter Milesson via samba wrote:
>> Unfortunately, that doesn't work. In share permissions, it's
not
>> possible to remove Everyone, nor add another security object. 
>> Clicking OK, the dialog closes without any errors, but opening it 
>> again, Everyone is still there. I was sure to start Computer 
>> Management as Administrator.
>
> are we talking share permissions or filesystem permissions? They are 
> two things...
>
> Have you granted SE_DISK_OPERATOR_PRIVILEGE which is needed iirc to 
> change share permissions?
>
Hi Ralph,

This post was about the share permissions tab. It would be OK, to use 
Everyone under share permissions, if it was possible to later select the 
security objects under the security tab (which is not possible).

Best regards,

Peter