Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to understand the samba rights management, but I think I missed a bit. I have 2 kinds of users: guests and users with a login via LDAP.

Now I try to override all permission settings in Samba via the following share configuration:

# directory creation mode
    directory mask = 0777
    force directory mode = 0777
    directory security mask = 0777
    force directory security mode = 0777

# user mapping
    force group = users

The wanted result (777 for directories) only works with guests:

> ls -lda *
drwxr-xr-x 2 sven   users 4096 2012-08-02 09:06 authenticated
drwxrwxrwx 2 nobody users 4096 2012-08-02 09:06 guest

I've also set unix extensions = no but this didn't change the behavior. The parent has set the permissions to 777. The only thing that currently works, is adding the sticky bit to Samba directory permissions - but this won't users let delete there files.

Seems authenticated users are allowed to change permissions even with the above settings - is there a way to completely override this?

share|improve this question
Maybe the individual users' umasks play a role here? – Daniel Beck Aug 6 '12 at 6:57
Thanks for this suggestion - but I couldn't find a hint on how to configure samba to ignore it. – Sven Aug 6 '12 at 10:59
up vote 3 down vote accepted

Fixed it by using 2777 instead of 0777. Currently I can't explain why that works, but it does. Please note that it sets the group ID bit, which means that files below have the group set to the directories group.

share|improve this answer
For me, 0777 works for Mac clients but not for Windows clients (good thing it’s a SERVER setting). If I set security = share, then 0777 works for Windows clients, but Mac clients cannot connect anymore. It must be a bug in Samba. – Olivier 'Ölbaum' Scherler Aug 9 '12 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .