Permissions "read only" after copying files FROM server

Question

Hi everyone!
OK, just setup a Leopard server. Clients all at Tiger - level..for now. This is what I want to do:
I want a read only - network library drive so that the clients can grab files from but then modify locally on their machines. No need to put back on that server as I have another system in place for things like that.
*The problem:* If I propagate permissions at "read only" then when the user copies to their local drives, the owner changes but the permissions remain. They have to manually change the permissions back to match their local, then they can work with the file. When we're talking about hundreds of files for 15+ users a day, then it is quite a pain and a show stopper.
I had this setup previously on a panther server with no trouble. I've maintained settings as close as possible but still having trouble.
Any ideas as to what I'm missing?
FYI- I don't want to change permissions to read/write to protect the library from tampering.
thanks

Answer 1

+If I propagate permissions at "read only" then when the user copies to their local drives, the owner changes but the permissions remain.+
OK, from your description, you'd have to have the POSIX owner's permissions set to just read-only or read and execute. As you've observed, a copy obtains permissions in the following manner:
The POSIX owner changes to match the account performing the copy (the action-bearing account), and the POSIX group is inherited from the copy's destination parent. The POSIX permissions stay the same, though. (Inherited ACL entries on the original are also lost; explicitly-defined ones are preserved, and new inherited entries apply to the copy from its destination parent.)
All of this is proper behavior, and there's an easy way to make it work to suit your needs.
Since the POSIX owner changes to the action-bearing account for the copy, you'll want to ensure that the original POSIX owner's permissions are read and write. This does not require that you make the original's POSIX owner the same as that of the action-bearing account. An example would better illustrate the situation:
Example POSIX Permissions for the Original on the server:
Owner root can read and write
Group somegroup can only read
Everyone else can only read
Thus, let's say that tsmith is the action-bearing account. So tsmith copies the file to his desktop, and the POSIX permissions now look like this:
Owner tsmith can read and write
Group staff can only read
Everyone else can only read
Thus, tsmith receives the POSIX permissions of the POSIX group or everyone else field on the server - let's say there are no ACLs for the time being - and he becomes the owner of the copy. Since the original owner, root on the server, had read and write permissions, those permissions are preserved and given to tsmith for the copy.
Another way to deal with this situation would be to use ACLs by placing an inheritable ACL granting full control or read and write for tsmith on his home folder. Any new items copied to or created in his home folder would inherit that ACL. Similarly, an inherited ACL deny entry (but not an explicitly-set entry) affecting tsmith and the delete and delete_child controls could be placed on the affected server share point's top-level before the original was copied there. Then, any subsequent copies from the server volume would drop this inherited ACL entry entirely. These would, however, be much more complicated situations, and your scenario is best handled in the POSIX-only fashion. (This doesn't mean that you have to disable ACLs on the server - just don't apply them for the share point!)
--Gerrit
search:Owner read only