POSIX ACLs, or Samba acl_xattr ACLs (or both)?

Posted by DeifniteProfessional@reddit | linuxadmin | View on Reddit | 8 comments

I'm tyring to delve deeper into the use of Samba on Linux, specifically for SMB network shares. I've had great success configuring self contained Samba shares where I've used write lists, local users, and Linux groups to manage access. But I want to move up to working with a bigger and more complicated system, where I've linked to a remote active directory server. Everything is working more or less as I expect, but I cannot for the life of me figure out permissions. I've poked around inside a similarly configured Unraid server, and it seems it uses POSIX ACLs for everything. Doesn't seem to be a mention of acl\_xattr VFS extensions, so my assumption is that it's using ACLs directly on the underlying XFS filesystem. So that leads me to the question, is it best just to use Samba as a translation layer between Windows and POSIX ACLs, or use (as well or instead of) Samba's extended attribute based ACLs? I'm not a total newbie when it comes to filesystems, but I appreciate there's gaps in my knowledge, so maybe I'm going down the wrong path, but I'm just trying to understand the "right" or "best" ways to manage such.

Reply to Post

8 Comments

[-]

mind-blender@reddit

My opinion is it is best to disable ACLs entirely unless you have some special need that Unix permissions are insufficient to handle. These ACL systems have caused me nothing but unnecessary work and grief.

[-]

DeifniteProfessional@reddit (OP)

Hey it's been an entire month and after spending literal days on learning how to do this properly, I've come to the conclusion that you're right, and you should either using UNIX permissions, or set the masks to 777 and use NT ACLs, do not even remotely try to combine them lmao

[-]

Ontological_Gap@reddit

You can still use the NT acls just fine if your users are only accessing the files through samba, it's the translation to and from posix acls that fuck everything up

[-]

DeifniteProfessional@reddit (OP)

My experiment is on the predicted use case that this would be used in a busy user setting where you may need to grant certain granular access to specific people, something traditional user:group permissions doesn't easily provide

[-]

Ontological_Gap@reddit

Unless you want to have users accessing their files by directly sshing to the system in addition to samba, I recommend setting "acl_xattr:ignore system acls = yes". This will tell samba to only use the security.NTACL extended attribute to store security info, and not mess around with trying to translate back and forth between Linux and NT security formats, which leads to nothing but pain. See here https://www.samba.org/samba/docs/4.22/man-html/vfs_acl_xattr.8.html and here https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#File_System_ACLs_in_the_Back_End

[-]

LinuxLeafFan@reddit

I’ll have to keep this in mind the next time I have to use samba.

[-]

DeifniteProfessional@reddit (OP)

Thanks, this makes a lot of sense and would work well for my theoretical use case. Not sure from reading what underlying permissions would look like (ie. when someone uploads a file, what would ls -l output show?) but I can test that! Thanks again

[-]

Ontological_Gap@reddit

It's whatever you set them to in Linux. I usually create a group, say marketing-users, add it to the samba valid_users stanza, set the share permission (using seDiskOperator) to require that group, then set the posix ACL in Linux to require that group for rwx, the posix permission will inherit, and samba will enforce the more granular permission (the first two steps are paranoia/"defense in depth", which is always a good idea when interfacing with windows).