I cant get samba to set proper permissions on created directories

Question

I have a ubuntu server sharing some folders using samba. When a client creates a new folder or file, the permissions aren't set according to the settings in smb.conf.

My current settings for a specific share:

[share]
    path = /mnt/share
    browsable = yes
    guest ok = no
    writable = yes
    read only = no
    create mask = 0774
    directory mask = 0774
    write list = netuser

When a samba client (a windows 7 box) uses the 'netuser' account to create a file or directory, the permissions become

drwxr-sr-- 2 netuser sambashare      4096 2012-01-22 21:14 New folder
-rwxrw-r-- 1 netuser sambashare         0 2012-01-22 21:07 New Text Document.txt

The parent directory has the set group id flag, thus the sambashare group owner. The idea is that both samba users and server users belong to the sambashare group, and thus are to be able to edit, delete, and create files and directories. However, since created folders doesn't have the write flag for group set, server users cant create new files or folders in those folders without sudo.

i have tested adding and removing the directory mask, force directory mode, directory security mode, and the force directory security mode, but the behaviors still remains. Newly created files and folders doesn't get intended 774 permission, but rather 764 and 754 respectively.

What am I missing? Why doesn't samba set the correct permissions?

Answer 1

I think you need to use the following parameters:

# I changes the permissions to rw-rw-r--
# You should be able to change them to 775 if you need the files to
# be executable
create mask = 664
force create mode = 664
security mask = 664
force security mode = 664

# I set the SGID flag here as I thought this is what you wanted
# You could change to 0775
directory mask = 2775
force directory mode = 2775
directory security mask = 2775
force directory security mode = 2775

I was looking for a nice explanation of how these settings work, but could not find anything better then man smb.conf

You will have to scroll down a bit for those options.

Basically, in a nutshell, windows permissions are not the same as unix (linux) and it is a bit odd how samba maps permissions.

Answer 2

I had the same problem, but everything like mask directives did not work for me (Samba 4.3.11):

 create mask = 0664
 force create mode = 0664
 directory mask = 02775
 force directory mode = 02775

The only option that worked was under the [global] or share section:

 inherit permissions = yes

Just change all folder and file permissions to your need, so future folders and files will inherit the same permissions.

Answer 3

After a lot of trial and error, this is the correct code to share samba dir using SGID and unix groups. If user connects anonymously he gets r/o, if he logs in and is a member of assigned group he gets r/w.

I have group named 'admin' set as primary group to users with write privileges, everyone else gets read only rights.

I force user to nobody, so different people working on same files don't interfere with each other.

I set chmod 2755 on shared directory, so it inherits created directories with the same group 'admin'

$ chmod -R 2755 /home/shares/test

Checking if all is good:

$ stat /home/shares/test
Access: (2755/drwxr-sr-x)  Uid: (65534/  nobody)   Gid: ( 1001/   admin)

Relevant part of /etc/samba/smb.conf:

[test]
        comment = test
        path = /home/shares/test
        force user = nobody
        read only = No
        create mask = 0664
        force create mode = 0664
        directory mask = 02775
        force directory mode = 02775

This post put me on right track, but testparm revealed 4 incorrect directives, so I'm sharing fixed config here. In samba, the less directives you specify the better it works.

Answer 4

There is a very similar problem when connecting from other Unix / Linux / OSX / MacOS devices: all of the settings are ignored unless you specify

[global]

unix extensions = no

And connect with smb://<serverhost> instead of cifs://<serverhost>.

Answer 5

 Here add this code to the sudo nano smb.conf
 and restart sudo service smbd restart  and access from another local PC/computer using connect with smb://<serverhost>  to create or edit files/folder   html is folder name 

 [html]
   comment = admin access
   path = /var/www/html
   browsable = yes
   guest ok = no
   writable = yes
   valid users = @admin
   create mask = 664
   force create mode = 664
   security mask = 664
   force security mode = 664
   directory mask = 2775
   force directory mode = 2775
   directory security mask = 2775
   force directory security mode = 2775