Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a ubuntu server sharing some folders using samba. When a client creates a new folder or file, the permissions aren't set according to the settings in smb.conf.

My current settings for a specific share:

    path = /mnt/share
    browsable = yes
    guest ok = no
    writable = yes
    read only = no
    create mask = 0774
    directory mask = 0774
    write list = netuser

When a samba client (a windows 7 box) uses the 'netuser' account to create a file or directory, the permissions become

drwxr-sr-- 2 netuser sambashare      4096 2012-01-22 21:14 New folder
-rwxrw-r-- 1 netuser sambashare         0 2012-01-22 21:07 New Text Document.txt

The parent directory has the set group id flag, thus the sambashare group owner. The idea is that both samba users and server users belong to the sambashare group, and thus are to be able to edit, delete, and create files and directories. However, since created folders doesn't have the write flag for group set, server users cant create new files or folders in those folders without sudo.

i have tested adding and removing the directory mask, force directory mode, directory security mode, and the force directory security mode, but the behaviors still remains. Newly created files and folders doesn't get intended 774 permission, but rather 764 and 754 respectively.

What am I missing? Why doesn't samba set the correct permissions?

share|improve this question
up vote 12 down vote accepted

I think you need to use the following parameters:

# I changes the permissions to rw-rw-r--
# You should be able to change them to 775 if you need the files to
# be executable
create mask = 664
force create mode = 664
security mask = 664
force security mode = 664

# I set the SGID flag here as I thought this is what you wanted
# You could change to 0775
directory mask = 2775
force directory mode = 2775
directory security mask = 2775
force directory security mode = 2775

I was looking for a nice explanation of how these settings work, but could not find anything better then man smb.conf

You will have to scroll down a bit for those options.

Basically, in a nutshell, windows permissions are not the same as unix (linux) and it is a bit odd how samba maps permissions.

share|improve this answer
Yes, that seems to be roughly the same manpage as which I looked at, the problem is that it doesn't seem to matter what octal values I set, I still get the same permissions set on the created file or folder. – Zaz Jan 23 '12 at 11:14
Did you set all the options I gave you ? If so, please update your first post and at that point I would suggest you file a bug report. – bodhi.zazen Jan 23 '12 at 16:10
It already said.. but on closer inspection and testing, adding the 2 to the directory masks did fix the problem. Many thanks. : D – Zaz Jan 23 '12 at 18:37
Fantastic, thank you for marking this as the accepted answer, it help others with a similar problem. – bodhi.zazen Jan 23 '12 at 19:14
Samba configuration is overly complex and really hard to understand. For example what is the logical difference between force create and just create... makes no sense. Your hint is a life saver though - thank you! – Matthias Hryniszak Feb 27 at 19:55

After a lot of trial and error, this is the correct code to share samba dir using SGID and unix groups. If user connects anonymously he gets r/o, if he logs in and is a member of assigned group he gets r/w.

I have group named 'admin' set as primary group to users with write privileges, everyone else gets read only rights.

I force user to nobody, so different people working on same files don't interfere with each other.

I set chmod 2755 on shared directory, so it inherits created directories with the same group 'admin'

$ chmod -R 2755 /home/shares/test

Checking if all is good:

$ stat /home/shares/test
Access: (2755/drwxr-sr-x)  Uid: (65534/  nobody)   Gid: ( 1001/   admin)

Relevant part of /etc/samba/smb.conf:

        comment = test
        path = /home/shares/test
        force user = nobody
        read only = No
        create mask = 0664
        force create mode = 0664
        directory mask = 02775
        force directory mode = 02775

This post put me on right track, but testparm revealed 4 incorrect directives, so I'm sharing fixed config here. In samba, the less directives you specify the better it works.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.