CIFS : how to make "admin" owner of all files/folders

[orconomix]

Hello.

I am trying to make a CIFS share in such way that the "admin" (user in wheel group) is automatically the owner of all files created by any user.

I have tried to disallow users to change permissions on files and folders they create within an share or folder while accessing the share as the admin user , but somehow the user1 is always able to change permissions and the admin user either can not see the file anymore or edit them after the user changed permissions.


My goal is to create a share where a user can create/edit/read/delete files BUT NOT change permissions , ONLY the admin is able to change permissions.

If you need further informations let me know and i'll get them for you.

In the following i show the steps i done.


in this picture you can see all the users that have access to this share







in the 2nd picture you can see the permissions the user1 has. and as you can see the user1 is not supposed to be able to change permissions on any files/folders







on picture 3 you can see all others are not supposed to see whats in the share at all or do anything







in picture 4 i switched to my VM and logged in on the share as user1 and have access to file permissions of the file i created as user1 and i have the ability to exclude the admin user who is bossman from the file , even though i did not not allow that.






in picture 5 i take away all rights from the admin user without without getting a message that i have no right to do so






in picture 6 you can see the content of the share which shows the share from the point of view of user1 (left side) who created the the file and took all rights away from admin (right side) and no files to be found from the admin file browser.






I' have been reading and trying all kinds of things and i just can not get it to work.

 

[anodos]

Caveat: have not had coffee this morning and was up late. Your miniscule screenshots are making my head spin.

<long, rambling, semi-coherent response> I believe this behavior is a side-effect of the parameter "nfs4:mode = special" in the smb4.conf. Basically, nfsv4 permissions has special "owner@" and "group@" IDs. I believe "apply default permissions" in the webgui grants full control to these special IDs. I think this has the side-effect that if the "owner@" permission is set to inherit and you change the owner from say "admin1" to "peon" on a subfolder, that peon receives the rights of "owner@".

IMHO, nfs4:mode should be set to "simple" rather than "special", but I am only level 4 in the dark arts of samba (not level 40 like the guys at IX).

</long, rambling, semicoherent response>

What if you try setting a separate "deny" ACE for the group of users that shouldn't be able to change permissions?

Maybe the resident permissions guru @cyberjock would like to weigh in. :D