default ACL issue on Debian + kernel 2.6.12.6 + Samba 3.0.22 + ext3

Hi,

I use samba 3.0.22 as PDC on Debian with workstations under windows XP =

SP1 and SP2.
The server is a Debian Sarge with  a custom kernel 2.6.12.6.
File system is ext3.
I use ACLs to have a fine grained access rules.
I tried the samba mailing list, but after reading =

http://acl.bestbits.at/pipermail/acl-devel/2005-January/001817.html I =

prefer post to this mailing list :)
So :

When I copy a directory from a client to a samba share, default ACLs are =

forgiven.
exemple : after I copy the directory A on the samba share :
getfacl A/
# file: A/
# owner: user1
# group: sambausers
user::rwx
group::---
other::---
default:user::rwx
default:group::---
default:other::---

But the parent directory has default ACLs, I can prove it :
getfacl .
# file: .
# owner: user1
# group: sambausers
user::rwx
user:root:rwx
user:bacula:r-x
group::---
group:sambaguests:rwx
group:User_Standard:rwx
group:User_Lead:rwx
mask::rwx
other::---
default:user::rwx
default:user:root:rwx
default:user:bacula:r-x
default:group::---
default:group:sambaguests:rwx
default:group:User_Standard:rwx
default:group:User_Lead:rwx
default:mask::rwx
default:other::---

Is it a bug ? because default ACLs are applied if I copy files. So Why =

different behavior between directory and files ?
I noticed that it happened only to local directories which belong to =

MYDOMAIN\user.  If the owner of the local directory is =

LOCALCOMPUTER\user the default ACLs is applied correctly. But once =

again, it concerns only directory. When the file belong to MYDOMAIN\user =

ACLs are applied correctly.

All what I want is that default ACLs are applied all the time whatever =

the owner of local directory.

I try to play with "directory security mask", "force directory security =

mode", inherit permissions without success.
Thank you for your help, I really don't know what to do.

If it can help, my smb.conf looks like that :

# =

---------------------------------------------------------------------------=
-- =


# Global parameters
# =

---------------------------------------------------------------------------=
-- =


[global]
      dos charset =3D 850
      unix charset =3D ISO8859-1
      workgroup =3D elb-lyon
      netbios name =3D server02
      server string =3D server02.elb-lyon
      os level =3D 65
      domain logons =3D Yes
      domain master =3D Yes
      local master =3D Yes
      preferred master =3D Yes
      wins support =3D Yes

      obey pam restrictions =3D Yes
      passdb backend =3D tdbsam, guest
      passwd program =3D /usr/bin/passwd %u
      passwd chat =3D *New*UNIX*password* %n\n *ReType*new*UNIX*password* =

%n\n *passwd:*all*authentication*tokens*updated*successfully*
      passwd chat debug =3D Yes
      pam password change =3D Yes
      unix password sync =3D Yes

      syslog =3D 0
      log level =3D 2
      # log level max =3D 10
      log file =3D /var/log/samba/log.%m
      max log size =3D 25600
      dns proxy =3D No
      panic action =3D /usr/share/samba/panic-action %d
      invalid users =3D root2

      # param=E8tres samba utilisateur par defaut
      logon drive =3D P:
      logon home =3D \\server02\%U
      logon path =3D \\server02\profiles\%U
      logon script =3D %U.cmd

      # gestion des comptes posix automatique :)
      # Gestion des comptes POSIX
      add machine script =3D /usr/sbin/useradd -g sambamachines -c =

Machine -d /dev/null -s /bin/false '%u'
      add user script =3D /usr/sbin/useradd -g sambausers -c Utilisateur =

-d /dev/null -s /bin/false '%u'
      add group script =3D /usr/sbin/groupadd '%g'
      add user to group script =3D /usr/bin/gpasswd -a '%u' '%g'
      delete user script =3D /usr/sbin/userdel -r '%u'
      delete group script =3D /usr/sbin/groupdel '%g'
      delete user from group script =3D /usr/bin/gpasswd -d '%u' '%g'
      set primary group script =3D /usr/sbin/usermod -g '%g' '%u'

      veto files =3D /lost+found/ .recycle/ aquota.user/ aquota.group/

      guest account =3D guest

      hosts allow =3D 192.168.0. 127.

# =

---------------------------------------------------------------------------=
-- =


# Necessaire Domaine
# =

---------------------------------------------------------------------------=
-- =


[homes]
      path =3D /mnt/SAN01/vd3_home2/home2/%u
      comment =3D Home Directories
      valid users =3D %S
      guest ok =3D No
      writable =3D Yes
      create mask =3D 0700
      directory mask =3D 0700
      browseable =3D No

[netlogon]
      path =3D /mnt/SAN01/vd3_home2/netlogon
      comment =3D Partage NetLogon
      valid users =3D @sambausers @sambaguests root
      guest ok =3D No
      read only =3D Yes
      browseable =3D No

[profiles]
      path =3D /mnt/SAN01/vd3_home2/profiles
      comment =3D Profils utilisateurs
      valid users =3D @sambausers @sambaguests root
      guest ok =3D No
      writable =3D Yes
      create mode =3D 0700
      browseable =3D No

# =

---------------------------------------------------------------------------=
-- =


# Partages
# =

---------------------------------------------------------------------------=
-- =


[vd1_echange]
      comment =3D Zone d'echange.
      path =3D /mnt/SAN01/vd1_echange
      valid users =3D root @sambaadmins @sambaguests @User_Standard
      guest ok =3D No
      writable =3D Yes
      create mask =3D 0770
      directory mask =3D 0770
      browseable =3D yes
      # inherit permissions =3D yes
      inherit acls =3D yes
      hide unreadable =3D Yes
      # directory security mask =3D 0000
      # force directory security mode =3D 0777


-- =

Sylvain DAVID / administrateur r=E9seau

         adr : Etranges Libellules
  .~.          17 Rue des Archers
  /v\          69002 LYON
 /(=B0)\   tel : 04 72 40 24 72
 ^^-^^   fax : 04 72 40 27 19

  www.etranges-libellules.fr
                                   --

_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel