Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to understand the samba rights management, but I think I missed a bit. I have 2 kinds of users: guests and users with a login via LDAP.

Now I try to override all permission settings in Samba via the following share configuration:

# directory creation mode
    directory mask = 0777
    force directory mode = 0777
    directory security mask = 0777
    force directory security mode = 0777

# user mapping
    force group = users

The wanted result (777 for directories) only works with guests:

> ls -lda *
drwxr-xr-x 2 sven   users 4096 2012-08-02 09:06 authenticated
drwxrwxrwx 2 nobody users 4096 2012-08-02 09:06 guest

I've also set unix extensions = no but this didn't change the behavior. The parent has set the permissions to 777. The only thing that currently works, is adding the sticky bit to Samba directory permissions - but this won't users let delete there files.

Seems authenticated users are allowed to change permissions even with the above settings - is there a way to completely override this?

share|improve this question
    
Maybe the individual users' umasks play a role here? –  Daniel Beck Aug 6 '12 at 6:57
    
Thanks for this suggestion - but I couldn't find a hint on how to configure samba to ignore it. –  Sven Aug 6 '12 at 10:59
add comment

1 Answer

up vote 3 down vote accepted

Fixed it by using 2777 instead of 0777. Currently I can't explain why that works, but it does. Please note that it sets the group ID bit, which means that files below have the group set to the directories group.

share|improve this answer
    
For me, 0777 works for Mac clients but not for Windows clients (good thing it’s a SERVER setting). If I set security = share, then 0777 works for Windows clients, but Mac clients cannot connect anymore. It must be a bug in Samba. –  Olivier 'Ölbaum' Scherler Aug 9 '12 at 14:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.