CIFS/Samba Group permissions

[jacobnollette]

Hi there,

we have a freenas mini xl. One zpool, and multiple subvols for our different sections of the share. We're using one single share point, of the tank. Additionally, every sub folder of the tank, or in this case, zvols, have their own cifs permissions. Our environment is 100% macs, using microsoft word, and adobe mainly.

We've been having issues where group permissions are not inherited. Any ideas? Over the past week we upgraded to 11.3-current. Since then these issues have been show stopped for a lot of people in our environment.

Please advise.

 

[anodos]

The macs might be changing permissions when it writes to the share (you can do this over SMB). Try setting an explicit entry granting MODIFY to the group (not group@).

 

[jacobnollette]

if not group@, would I replace group@, or add a third entry with your explicit grant? Not clear what you mean.

 

[anodos]

if not group@, would I replace group@, or add a third entry with your explicit grant? Not clear what you mean.

leave things as is, add third entry for GROUP <your group>.

 

[jacobnollette]

Do I need additional samba mount flags to force 770? Not sure I understand this part.

 

[anodos]

Do I need additional samba mount flags to force 770? Not sure I understand this part.

What is aclmode property of the ZFS dataset underlying the share?

 

[jacobnollette]

passthrough

 

[anodos]

passthrough

Then depending on open mode by smb client, you may end up with samba's create mask being applied. Try setting aclmode to "restricted" (which is our default for SMB datasets).

 

[jacobnollette]

Seems like the permissions are correct with that change, however it seems like microsoft office products are still thinking the files are read-only, or locked. Any ideas there?