SDDL reset?!

We have setup a share with full NTACL permission, eg with:

	vfs objects = acl_xattr
	acl_xattr:default acl style = windows
	acl_xattr:ignore system acls = yes

after a bit, we change our mind and switch to 'normal' ACL (eg, posix
compatibility):

 [Software]
	comment = Software e Drivers
	force create mode = 0664
	force directory mode = 0775
	force group = ven_ad_admin
	inherit permissions = Yes
	map acl inherit = Yes
	path = /srv/share/software
	read only = No
	vfs objects = acl_xattr
	volume = Software

permission are currently:

 root@sdfs1 software]# getfacl /srv/share/software/
 getfacl: Removing leading '/' from absolute path names
 # file: srv/share/software/
 # owner: ven_ad_admin
 # group: ven_ad_admin
 user::rwx
 group::rwx
 other::r-x

but if i access the share with an unprivileged user (or at least, NOT member
of 'ven_ad_admin' group) i can easily create folder and write file to the
share.


I suppose some 'old' NTACL permissions remain in the share; SDDL of the
folder currently is:

 [root@sdfs1 software]# samba-tool ntacl get /srv/share/software/ --as-sddl
 O:S-1-5-21-1128540416-1778674618-732667697-1743G:S-1-5-21-1128540416-1778674618-732667697-1743D:P(A;;FA;;;S-1-5-21-1128540416-1778674618-732667697-1743)(A;;FA;;;S-1-5-21-1128540416-1778674618-732667697-1743)(A;;0x1200a9;;;WD)

it is needed to do an:

 setfattr -x -n security.NTACL /srv/share/software/

?! Thanks.

-- 



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba