Often administrators would like to configure a Samba share that enables users to have the same access to any files within the share. Without some additional configuration, directories and files created by one user will not have the r/w permissions for other users that have access to that same share.
The end goal is to have a Samba share in which any new files are created with r/w permissions for a specific group to which all of the members of the share belong.
The first step is to determine whether the current running kernel supports ACL. To do this we check the configuration file that was used to build the kernel, looking for config keys that contain the string ‘POSIX_ACL’.
Determine the version of your current kernel
uname -a
Linux leviathan 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
Then grep the config file for your kernel
grep POSIX_ACL /boot/config-2.6.32-358.2.1.el6.x86_64
CONFIG_EXT2_FS_POSIX_ACL=y
CONFIG_EXT3_FS_POSIX_ACL=y
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_JFFS2_FS_POSIX_ACL=y
If the configuration for the filesystem type that you are using on the disk on which you want to configure the share indicates ‘y’, then you can continue to the next step. If not, you will need to recompile your kernel with ACL support.
Next, check the configuration entry in /etc/fstab for the filesystem that we want to use.
/dev/sda1 /usr/local2/ ext3 defaults 1 2
In this case, our filesystem is not yet configured to use acl as it is not noted after the ‘defaults’ option.
Edit /etc/fstab and change that option to read ‘defaults,acl’ as follows:
/dev/sda1 /usr/local2/ ext3 defaults,acl 1 2
Unmount, and then re-mount the filesystem.
Next, ensure that you already have a group configured for the users in question and that those users belong to that group. For this example our group will be ‘sharegroup’
Then, create the directory that you want to share via Samba and set the permissins and acl for it.
mkdir /usr/local2/share
Change the group ownership, permissions, and set the sgid flag.
chgrp sharegroup /usr/local2/share
chmod g+w share
chmod g+x share
chmod g+s share
Now we set the acl for the directory. The following sets the default group to ‘sharegroup’ with permissions of ‘rwx’.
setfacl -m d:g:sharegroup:rwx share/
The last thing to do is to set up the share in Samba. Edit /etc/samba/smb.conf
[share]
comment = Shared Directory
path = /usr/local2/share
valid users = user1 user2
browseable = yes
writeable = yes
create mask = 2664
directory mask = 2775
The key configurations are the create and directory mask which will ensure that files are created with the proper group permissions to enable all of the users the desired access.
Restart samba and you are finished.
If you copy an existing directory into the share directory you will need to modify the permissions so that it is available to all of the users who have access to that share.
Add sgid permissions to all of the sub directories:
find ./new_dir -type d -exec chmod g+s {} \;
Add executable permissions for the group to all of the sub directories:
find ./new_dir -type d -exec chmod g+x {} \;
Add write permissions to all files and directories in the new dir:
chmod -R g+w ./new_dir