I want one of my share to be:
- accesible only for selected users
- folders (and subfolders) in that share to be accesible for read (and/or write) for subset of my users
- all files should have nobody:my_group permissions (because of quota on the other shares)
I've setup ACL @ /etc/fstab and all that getfacl and so on works. Changing permissions from Windows station also works. But i cannot get it to work the way I want.
My smb.conf (fragments):
[global] workgroup = XXX server string = %h server (Samba, Ubuntu) map to guest = Bad User obey pam restrictions = Yes pam password change = Yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . unix password sync = Yes log level = 3 syslog = 0 log file = /var/log/samba/log.%m max log size = 1000 dns proxy = No usershare allow guests = Yes panic action = /usr/share/samba/panic-action %d [....] [THE_SHARE] comment = The Share path = /VOL/THESHARE valid users = @users admin users = admin_me write list = admin_me force user = nobody force group = samba-groups create mask = 0700 directory mask = 0700 inherit permissions = Yes inherit acls = Yes guest ok = Yes
Selected users at THESHARE are with proper acls:
admin_me@XXX:/VOL$ getfacl THESHARE/ # file: THESHARE/ # owner: root # group: samba-groups user::rwx user:user1:r-x user:user2:r-x group::--- mask::r-x other::--- default:user::rwx default:user:user1:r-x default:user:user2:r-x default:group::--- default:mask::rwx default:other::---
So users user1 and user2 should by default have read only acccess to THESHARE.
Now I created a folder in my share with permissions:
admin_me@XXX:/VOL/THESHARE# getfacl user1Full/ # file: user1Full/ # owner: nobody # group: samba-groups user::rwx user:user1:rwx group::rwx mask::rwx other::--- default:user::rwx default:user:user1:rwx default:group::--- default:mask::rwx default:other::---
So user1 should have full access to that folder, and user2 should not have any access to it.
Well, that theory. In practice it does not work. I'm a little confused where to start over all of this, maybe someone will help to point me out my mistakes.
Currently no one (except admin_me) have access to write/create folders or files, and both users are able to go through folders without permissions to read it.