I am the co-administrator of a small private school's domain system. I set the system up using Zentyal 3.4 of which Windows and Ubuntu clients both connect. Students have their own personal logins with their personal "Server Drive" of 500Mb space on the server. These "Server Drives" are the users' home folders (ie, user john.smith server drive is under /home/john.smith).
I have had multiple problems with the permissions before. By mixing ubuntu's drwxrwxrwx permission system and Zentyal's ACLs, I managed to get all administrators access to the users files by creating a symlink to the home folder that only admins have permission to. I used the Zentyal File Sharing (Samba) to add this to Samba, and it worked for a while. (/userfiles is symlink to /home that only admins can access. I do this because Samba will mess up if I create a share with /home since that is what the users are using when they get their Server Drive, duplicate samba entries I guess).
Each user's home folder is owned by them as the user but owned by Administrators as the group. Perms are set to 770 for all of them, including any sub-folders, the typical user's folder will look as follows:
drwsrws--- 4 john.smith Administrators 4096 Aug 15 16:02 john.smith/
The users can access all their files, and the admins can access their files as well. The problem comes when the users create their own personal folders. In /etc/skel, the users start with a Documents and a Pictures folder. Anything in here (not including subfolders) is readable by any admin. If a user creates a personal folder anywhere (ie /home/john.smith/Computer Class), admins can't read it.
I have tried fixing the problem by doing:
for line in `ls -1` do chown $line:Administrators $line -R chmod 770 $line -R done
This basically sets the permissions of all folders and files to that seen above. It still doesn't work. I've also tried doing:
setfacl -b john.smith
Still nothing. There is no difference between ACL and ubuntu's permission system results of the Documents or Pictures folder (readable) and the users' personally created folders (non-readable). What am I doing wrong here? Any suggestions to clean up this mess? How can I get these permission to how I need them to be?