Help with ACL on dir/files

UNIX Solaris
1

Hello,

I'm looking for some insight on ACL's in particular in regards to directories (but I guess files as well).

Here is what I would like to achieve.

A shared directory (by samba) that is mapped on a Windows box as a netowrk drive, any members of a specific domain group should have complete access to this share and anything in it, while everyone else who is not in the group doesn't. User auth comes from a Windows DC.

The link between the Unix box and the DC is working correctly.

If I issue the following command:

chmod A=group:DOMAIN+'domain group':rwxpdDaARWcCos:fd:allow Accounting/

I am able to access the files and directories (first level) without issue.

I can create new directories and new files as well as rename and delete existing ones.

I cannot however figure out why after creating a new directory I cannot access it (general Access denied error under Win) or save to a new created file (txt doc as a test).

I cannot use the recursive option of chmod as it gives me an error of:

chmod: ERROR: Inheritance flags are only allowed on directories
See chmod(1) for more information on valid ACL syntax

Can anyone shed some light on the situation? I am a *nix n00b, I've "played around" for a few years in Linux but this is the first time I've really gotten my hands dirty with permissions.

I have searched numerous documents on google for answers, but I can't seem to find any relevance (most docs talk about this command for "files"). I've also searched this forum for ACL directory and didn't find anything useful.

OS ver. Sun Solaris 10

Cheers!
Sascha

2

What is the output of ls -lVd your_new_dir ???

Also, you might want to remove the 'c', 'C' and 'o' options from your ACL since they allow the user to modify the ACL itself.

3

Thanks I will note that..

output is this:

(ignore the space after the group: I put that there to avoid it changing into a emoticon)

4

Is that the only ACE in your ACL? I think you should have at least two or three default ACEs.

Anyway, maybe the space is causing some noise to the ACL, have you tried escaping it? E.g.:

chmod A+group:DOMAIN+domain\ group:rwxpdDaARWs:fd:allow Accounting/

What is the ACL of "Accounting"?

After creating a directory, if you assing the same ACL by hand, does it work?