I have finally solved my SMB sharing troubles

Question

Hi!
I have read two most enlightening postings regarding ACLs and POSIX rights. I have always seen that they both affect access rights but have not been able to figure it out quite right. It seems very easy on first sight but it is not. Just try to edit MS Office document on a Windows PC right on the SMB share and you will see what I am talking about. But to cut the long story short, here's what I have done with my SMB configuration and why.
1) I modified /etc/smb.conf to disable streams support.
; stream support = yes
vfs objects = darwinacl
We don't need or use streams on our shares, buaving them enabled will occasionally block files from being read from the share. So in our case it is better to disable them.
2) I have removed all Deny statements from ACLs.
If you edit documents on the SMB share using MS Office, ACLs get messed up big time. The most important thing is that you don't know where you Deny ACEs will end up, so they could be the first thing in the ACL and you could be denied of any access.
3) I have set all POSIX rights to None on all directories and files.
darwinacl module will combine the POSIX rights and the ACL and will show POSIX rights as ACL entries to the Windows client. If the Windows client now saves something, the combined entries will all land in the saved file's ACL. E.g. if you have POSIX right r/w for group staff, the ACL will have an entry for group Users afterwards.
All in all I have only set ACLs to allow selective Allow rights for directories and no Deny statements at all. It works pretty well on Windows clients and also on Mac SMB clients. I have not enabled AFP at all for easier management.
The only downside is that the access-rights-limited directories are still listed for everyone who has access to the level above them.
Oh, for everyone who is interested in the two postings I read and found so good, here's the link:
http://lists.apple.com/archives/Macos-x-server/2008/May/msg00335.html
See the reply too, that's the second interesting posting.
Hopefully someone will find this information helpful! I have seen too many cries for help on this same issus.
Best regards,
Andrus Suitsu

Answer 1

I have experienced some new troubles with my shares. This time it is with OS X 10.6.2 smb client only. If a Windows user creates a new folder on a Leopard share, it has all the good POSIX rights and good ACL also. The POSIX owner has changed to the creator, but that should be fine. But still only the creator can access that folder over SMB from 10.6.2 client. Windows XP clients are not affected by this problem. From the Server Manager everything looks good, only the POSIX owner is different. Looking at the directory from the command-line reveals that the new folder has Execute bits set while other have not. Clearing the X bits made the problem go away.
You cannot change the share settings directly in /var/samba/shares because Leopard will overwrite your changes. So I changed the share settings using WGM (log in to Local). Clicked the last icon (2 concentric rings) and chose SharePoints. Then went and changed smb_createmask and smb_directorymask to 0000. This is okay, because I use only ACL to grant access to whoever needs it.
I then ran the /usr/libexec/samba/synchronize-shares script to write out the files in /var/samba/shares. After restarting the SMB service, things were once more better than before I started. New folders and files are created with empty POSIX rights, which is exactly what I need.