4

I'm running on Ubuntu Server 12.04. I have a folder called Music and I want the default folder permissions to be 775 and the default file to then be 664.

I set the default permissions on the Music folder to be 775.

I configured ACL to use these default permissions as well:

# file: Music
# owner: kris
# group: kris
# flags: ss-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x

I also changed the default umask for my user account, kris, to 002 in .profile.

Shouldn't and new file/folder now use those permissions when writing to the Samba share? ACL should work with Samba from what I can gather.

Currently, if I write to that folder using my mac, folders are getting 755 and files 644. I have another app on my mac called GoodSync which which is able to sync a local directory on my mac to a network samba share, but those permissions are even worse. files are being written as 700 using that program.

So it looks like Samba is allowing the host/program to determine the folder/file permissions.

What changes do I need to make to force the permissions I want regardless of what the host tries to write on the server?

1
  • UMASK for SMB?? Kind of, it took me years ... no, Samba does not superseed other settings. The limit is set in /etc/login.defs UMASK Put a 002 instead of 022 and you can give group write access in Samba SMB! The Samba UMASK is in /etc/login.defs ..... May 22, 2020 at 17:23

4 Answers 4

12

SAMBA/UMASK

Running Ubuntu 14.04, samba Version 4.1.6-Ubuntu. I was previously running Fedora 16/samba3 and everything was OK. With Ubuntu/samba4, I could not get Samba to set group write bit on directories.

smb.conf parameters (for testing) included:

create mask = 700             # The file AND mask  
force create mode = 775       # The file OR mask  
directory mask = 700          # Directory AND mask  
force directory mode = 777    # Directory OR mask  

From Windows 7 client, I could create files with mode=775, but created directories always had mode 755.

The problem is with default "UMASK 022" on my personal login which I use to access the shared directories. Edited /etc/login.defs and changed "UMASK 022" to "UMASK 002". Rebooted, and now directories created from Windows 7 client have mode=775. I do not believe this was the same behavior as my previous setup (Fedora/Samba3).

Interestingly, smb.conf parameter "inherit permissions = yes" kind of worked. This parameter supersedes the previous parameters. With parent directory having mode=2777, created subdirectories had mode=766 (the execute bits weren't set), and files had mode=755 (the group/guest write bits weren't set).

The Samba/UMASK interaction and interdependency should be documented.

4
  • I tried every response under the sun, and could not understand why my group's write permission was never getting set. Lo and behold, /etc/login.defs UMASK was overwriting my account's self-reported umask value. Thank you for figuring this out! Feb 15, 2018 at 22:35
  • Is there some way to change that UMASK setting for SAMBA only instead of system wide? Mar 11, 2019 at 10:27
  • @peter-c this was the solution I hoped for! Ubuntu 20.04 Samba doing fine again :-) Thanks a lot. Now the settings in smb.conf are not limited any loger and I can use 774 or even 770 - Great solution! May 22, 2020 at 15:34
  • This is not working on my Ubuntu 20.04. (on Mac Catalina client, need to test from Windows) Dec 5, 2020 at 2:44
7

Finally figured this one out.

You need to modify the /etc/samba/smb.conf file. For my Music share, I added the following options:

create mask = 664
force create mode = 664
security mask = 664
force security mode = 664
directory mask = 2775
force directory mode = 2775
directory security mask = 2775
force directory security mode = 2775

I'm not sure which one of those actually fixed the issue, but it is writing the correct permissions now when sharing via Samba. I think it's the "force" command being used since the Mac is likely trying to force it's own permissions on the share (and now Ubuntu is forcing it's own permissions instead of accepting my Mac's). Hopefully that helps someone!

1
  • 3
    You don't need any of the "security" parameters in Samba 4 - FYI Oct 12, 2016 at 12:34
2

The following entries worked for me:

force security mode = 664
force directory security mode = 775
1
1

One simple note. Look for "obey pam restrictions" parameter. By default it is OFF or NO or FALSE, but should it be turned ON explicitly, and the umask takes effect! I lost about a week, trying to figure out why my files created with 744 permissions regadless of force create mode 666 or 777... Problem was in this paramater turned ON, and I can't remember why I did that. Turning it OFF solved the rw-vs-ro problem

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .