Re: SDDL reset?!

On Mon, 9 Mar 2026 11:44:30 +0100
Marco Gaiarin via samba <[email protected]> wrote:

> 
> We have setup a share with full NTACL permission, eg with:
> 
> 	vfs objects = acl_xattr
> 	acl_xattr:default acl style = windows
> 	acl_xattr:ignore system acls = yes
> 
> after a bit, we change our mind and switch to 'normal' ACL (eg, posix
> compatibility):
> 
>  [Software]
> 	comment = Software e Drivers
> 	force create mode = 0664
> 	force directory mode = 0775
> 	force group = ven_ad_admin
> 	inherit permissions = Yes
> 	map acl inherit = Yes
> 	path = /srv/share/software
> 	read only = No
> 	vfs objects = acl_xattr
> 	volume = Software
> 
> permission are currently:
> 
>  root@sdfs1 software]# getfacl /srv/share/software/
>  getfacl: Removing leading '/' from absolute path names
>  # file: srv/share/software/
>  # owner: ven_ad_admin
>  # group: ven_ad_admin
>  user::rwx
>  group::rwx
>  other::r-x
> 
> but if i access the share with an unprivileged user (or at least, NOT
> member of 'ven_ad_admin' group) i can easily create folder and write
> file to the share.
> 
> 
> I suppose some 'old' NTACL permissions remain in the share; 

Er no, you appear to be shooting yourself in the foot.

'others', that is, anyone can access the share, where you have set
'force group = ven_ad_admin'. This means that the user becomes a member
of the 'ven_ad_admin' group and that group has full control.

Rowland

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba