Samba: ACLs, Inheritance and Ownership

Hey guys,

I've been struggling with a Samba installation on Solaris. Before I give up and go with something much simpler for the access control I'd like to have a final pop and getting it to work as I want.

Samba 3.2.1 is running on Solaris 10 patch 5, the server is a member of my AD domain, using Kerberos authentication, etc etc. That part all works well.

All shares for Samba reside on a ZFS file system. I have set:

zfs set aclmode=passthrough
zfs set aclinherit=passthrough

I have three issues that I was  hoping to address:

1. Ownership

I can't see to use the Samba "inherit owner" option, either because the file system is ZFS, or because I'm telling Samba to use ZFSACL (VFS Object).

Is there another way to force the owner and group of a new file to inherit from the parent? Or am I just missing something silly?

2. Inheritance

It mostly works. Unfortunately the ways it doesn't work make it quite sad.

Here's my base ACL (short format):

drwxrwx---+  3 root     root           3 Sep  1 14:19 dentc
    owner@:--------------:------:deny
    everyone@:-----------C--:fd----:deny
    owner@:rwxp---A-W--o-:fd----:allow
    user:dentc:rwxpd-aARWc--s:fd----:allow
    group@:rwxp----------:------:allow
    group:"domain admins":rwxpdDaARWcCos:fd----:allow
    everyone@:------a-R-c--s:------:allow

It does exactly what I need, in that it stops people messing with the permissions, but also stops Windows whining about re-ordering. That means I can maintain these permissions through the Windows GUI without it breaking horribly.

The problem is, newly created files get these additional ACEs added:

    owner@:--------------:------:deny
    owner@:rwxp---A-W-Co-:------:allow
    group@:-w-p----------:------:deny
    group@:r-x-----------:------:allow
    everyone@:-w-p---A-W-Co-:------:deny
    everyone@:r-x---a-R-c--s:------:allow

Built from the file mode (755). Is there any way to stop that so I only have the inherited extended ACL?

3. Propagation

Bearing in mind this is intended to retrofit onto an existing Samba server (after a lot of upgrading) which uses user mapping to Unix accounts (no integration at all):

How do I (or can I) force propagation of extended access control lists? Because at the moment those that I have on my test system only apply to newly created files unless explicitly set.

Thanks,

ChrisStart Free Trial