1

I am building a backup server using Linux, ZFS, and Samba. All clients other than me will be using Windows 10, therefore my focus is on supporting Windows 10 properly, but that does not mean the permissions on the Linux side should be allowed to be insecure (i.e. world readable and writable).

After mistakenly removing the POSIX ACLs on all files, thinking they were something initially set to allow group access, all the permissions on the files on the Windows side got broken.

This was fixed by going over every option in the manual and redoing the config I figured out which options to set to get the behavior I want, namely to set the permissions on the Windows side alone, while keeping the UNIX permissions safe, however there are still 2 things I do not understand about how Samba deals with UNIX permissions.

Setting acl_xattr:ignore system acls = no causes UNIX permissions to become entries in the Windows ACLs (CREATOR, GROUP, and EVERYONE entries), which I did not want, however when set to yes, the owner, group and permissions still seem to impact the permissions on the Windows side, they are still enforced by Samba. If a directory had root:backup 0660 permissions, then a random Domain User will not have access to that directory, even though the Windows ACLs had an entry for Domain Users. Changing the group from backup to users where users maps to the NT group Domain Users, then it will work. So clearly the UNIX permissions are still enforced.

Is there a setting to make the Windows ACLs veto the rest, i.e. if the Windows ACLs allow Domain Users, then they will be allowed regardless of what the UNIX permissions might say? Or could I just disable Samba using the UNIX permissions?

The other question is how Samba stores the UNIX permissions. In the new configuration I had inherit owner = yes. This seemed to work as expected on both Windows as UNIX, except when I tried to change the UNIX group to something else. Initially the setgid bit was set on the shares with john as their group, thinking inherit owner only affects the owner, not the group. However when removing the setgid bit from the shares and changing the group to users recursively, with inherit owner = yes new files and directories made from a Windows 10 client were still created with the group john. Nowhere in the directory tree was there a directory with group john left, I tried restarting my Windows client and the Samba server just in case, but that did not change anything.

Does Samba store the UNIX permissions elsewhere, so my changing of the UNIX group directly from the file system does not affect the group tracked by Samba? Or what might be the cause that Samba still uses this old group for new files and directories?

Below you can find the potentially relevant options of the Samba version 4.7.6 configuration. If more information is needed, let me know.

[global]
access based share enum = yes
acl group control = no
acl map full control = yes
acl_xattr:ignore system acls = yes
acl_xattr:default acl style = windows
create mask = 0775
directory mask = 0775
dos filemode = yes
dos filetime resolution = no
dos filetimes = yes
ea support = no
force create mode = 0600
force directory mode = 0600
force unknown acl user = no
guest account = nobody
guest ok = no
guest only = no
inherit acls = no
inherit owner = unix only
inherit permissions = no
invalid users = root
map acl inherit = yes
map archive = no
map hidden = no
map readonly = no
map system = no
map to guest = never
nt acl support = yes
obey pam restrictions = no
read only = yes
restrict anonymous = 2
security = user
server role = active directory domain controller
store dos attributes = yes
unix extensions = yes
vfs objects = dfs_samba4 acl_xattr shadow_copy2

[backups]
create mask = 0660
directory mask = 0770
ea support = yes
path = /mnt/pool/backups
read only = no
0

Does Samba store the UNIX permissions elsewhere, so my changing of the UNIX group directly from the file system does not affect the group tracked by Samba? Or what might be the cause that Samba still uses this old group for new files and directories?

I have only been able to find an answer to this second question. During my experimentation with inherit owner I at one point wanted to know what the values were that were stored as part of the NT ACLs, so I inspected a directory with samba-tool ntacl get /path/to/dir and to my surprise I saw the old GID as the value of the group_sid. And since I no longer had any other reference to the old GID anywhere else in the file system, this seems the likely cause for Samba holding on to the old UNIX group, especially since whenever I set inherit owner to unix only or no, it will not have the old UNIX group. So apparently setting inherit owner to yes (i.e. unix and windows), causes Samba to set the UNIX group to the group stored in the NT ACLs.

I would still love an answer to the first question, but I have found a workaround by finding a way to map the NT group Domain Users to my preferred UNIX group and setting the permissions of others to 0 via POSIX ACLs: setfacl -Rm d:o:---,o:--- /my/share.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.