2

I have a Samba share server running Ubuntu. After upgrading to 14.04, I had Samba upgraded from 3 to 4. Since then, I can't get group write permission on my newly created directory or files.

What was previously working in Samba3 was using these settings:

security mask = 000
force security mode = 660
directory security mask = 000
force directory security mode = 770
force user = nobody
force group = Domain Users

These settings were removed in Samba 4 (see https://wiki.samba.org/index.php/Samba_4.0_Features_added/changed#smb.conf_changes).

But now, my directories are created "drwxr-x--- 2 nobody Domain Users" and my new files "-rwxr-x--- 1 nobody Domain Users".

So what is the way in Samba 4 to allow my users to create and share with write permissions new directories and files ?

Here is my full samba config:

[global]
    workgroup = WORKGROUP
    server string = %h server (Samba, Ubuntu)
    interfaces = 127.0.0.0/8, eth0
    map to guest = Bad User
    obey pam restrictions = Yes
    passdb backend = ldapsam:ldap://ldap
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    load printers = No
    domain master = Yes
    dns proxy = No
    ldap admin dn = cn=root,dc=example,dc=com
    ldap group suffix = ou=Groups
    ldap idmap suffix = ou=Idmap
    ldap machine suffix = ou=Computers
    ldap passwd sync = yes
    ldap suffix = dc=example,dc=com
    ldap ssl = no
    ldap user suffix = ou=People
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    idmap config * : backend = tdb

[CommonShare]
    comment = Common share
    path = /srv/samba/common
    valid users = @myusers
    read only = No
    create mask = 0660
    force create mode = 0770
    directory mask = 0770
    force directory mode = 0770
    inherit permissions = Yes
    inherit owner = Yes

6 Answers 6

2

While researching this problem, I stumbled onto this Samba mailing list message:

https://www.spinics.net/lists/samba/msg169260.html

In it, a developer implies that Samba completely ignores traditional Unix file permissions when a client asks for the file's permissions. So if you right-click on the file from Windows and look at its permissions, it will show up as having no group write permission. While in most cases this is fine (Windows leaves it up to Samba to enforce the permissions), it makes a file effectively non-group-writable if it's in Word format, since Word checks the permission and switches to a special read-only mode if it thinks (incorrectly in this case) the file isn't writable. OpenOffice does the same thing.

To work around the problem you must add an ACL to whatever file you want to be group writable using certain Windows programs:

apt-get install acl # Not installed by default on Debian
setfacl -m 'group:<group-name> :rw' <filename>

If you mistype the group name, setfacl will report it as if it was a syntax error. The space before :rw is required. After this command succeeds, the group write permission will show up for Windows programs that check it.

2

To fix the problem you may add the force user username to the list of valid users for the share.

In your case:

[Myshare]
...
valid users = @bureau
...

should be:

[Myshare]
...
valid users = nobody @bureau
...
1
  • Great, this works !
    – alci
    Nov 18, 2014 at 11:30
2

This same problem happened to me.

I had to update the access control lists of all directories with the default group permissions:

sudo setfacl -R -m d:g:family:rwx /mnt/backup

-R = recursive
-m = modify
d: = defaults
g: = group name ("family" in my case) or gid number
rwx = default permissions read write execute for all in group

/mnt/backup is the directory (and subdirectories) to modify.

2

I know this is an old thread, but this might help someone. I solved this by setting the setgid bit to 2 (instead of 0) so the directories / files are created with group write permissions, e.g.

force create mode = 2777 force directory mode = 2777

From : https://linuxconfig.org/how-to-use-special-permissions-the-setuid-setgid-and-sticky-bits#h7-the-setgid-bit

0

The first four parameters have been removed, not the last two (see: https://www.samba.org/samba/docs/man/manpages/smb.conf.5.html#FORCEUSER).

So, just put them back in the config file and that should solve the problem. If you want write permissions to users in a particular group, add the write list parameter. It provides ability to grant write permissions to specific users or groups.

Here is an example of a config I use to allow creation/modification of files to all users belonging to a specific group (and only these users):

[Myshare] writeable = yes path = /shares/office force directory mode = 770 force create mode = 770 force group = bureau valid users = @bureau write list = @bureau .

2
  • force user and force group are indeed still valid parameters, but it does not change anything. Files and directories are created as Nobody / Domain Users anyway (don't know why, maybe inherit owner ?, but are NOT group writable...
    – alci
    Nov 17, 2014 at 8:13
  • See edited version of my answer. Basically, use write list parameter. Nov 17, 2014 at 12:43
0

Mask parameters don't change anything, even force parameters don't change behavior with group bits. For me only this config worked:

[global]
store dos attributes = yes  (for correct office hidden files)

obey pam restrictions = no  (!!!!)

[shares]
create mask = 7770
directory mask = 7770
force group = [one_group_for_all_shares] 

(nothing critical, there is parameter valid users, where I am grouping users for shares )

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.