Linux – Samba default permissions not respected

linuxsambaUbuntu

I'm almost ready to tear my hair off (At least i have a decent amount of it :P)

I built a Ubuntu 11.04 box at work for all the development team to work on it. Everything working fine so far but there is a small problem about default file permissions.

I've been searching for over 2h how to set the default permissions for files and folders when someone create something on the samba share.

So far, from my linux machine to the linux server through SMBFS, it works fine for directories and they are tabbed DRWXRWX— which is what i want.

The files tho are not set to -RW-RW—- like i want. The darn group write never wants to light up.

I've tried a combination of all the possible configuration flags for create mode, create mask, force create mode force security mode, nothing works. So i finish by asking here.

Relevant config file section:

[homes]
comment = Home Directories
browseable = yes

# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
read only = no

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
#   create mask = 0660
   create mode = 0660
#   force security mode = 0660
#   force create mode = 0660

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
#   directory mask = 0777
#   force directory security mode = 0770
#   force directory mode = 0770
   directory mode = 0770

valid users = %S

Best Answer

It sounds like you may have already tried this combination but my samba shares are set up like this, and new files and directories are created with the correct permissions if that's any help:

[public]
comment = samba share
path = /path/to/my/share
browseable = yes
force group = smbuser
create mask = 0660
directory mask = 0660

Related Solutions

Samba Permissions – I’m going to throw it!

This might help. I do something similar, but only one share is open to the group's users. Other shares are read-only except for a single maintainer user. The [global] section of my smb.conf is almost identical to yours, except I don't use the force create/directory mode directives (in my case, they'd interfere with the other shares).

Here's the share definition:

[shared stuff]
        comment = blah, blah, etc
        path = /path/to/share
        write list = @sambagroup
        force group = +sambagroup
        read only = yes
        directory mask = 0775
        create mask = 0664
        guest ok = yes
        invalid users = root
        case sensitive = True
        default case = lower
        preserve case = yes
        short preserve case = yes

The important stuff here are these:

read only = yes -- by default, read only.
guest ok = yes -- guests can browse.
write list = @sambagroup -- Authenticated members of sambagroup can write.
force group = +sambagroup -- The + means that the force only applies to existing members of sambagroup. They're already the only ones who can write. I think, without the +, guest is given sambagroup credentials, which is not wanted (particularly with the write list directive above).
directory mask = 0775
create mask = 0664

These do exactly what you want yours to do: "drwxrwxr-x" on directories, "rwxrwxr-x" on files, and newly created files are owned by the user and sambagroup. The maintainers of the other shares get the same permissions as everyone else when working in shared stuff, and permissions & groups are normal when they work in the other shares.

My smb.conf has been working with only minor tweaks through several different versions of Samba, and currently is used with Samba 3.2.5. I never had it running on Ubuntu 8.04, but it ran on Ubuntu 7.04 for a long time before getting migrated to a recent Debian Lenny install.

Samba – Create files/dirs as group

You can use the force group directive in your share definition to force that a particular group be used for all files on that share.

Related Topic