1.9. Setting up a share that uses Windows ACLs

Procedure

1. For example, to grant the SeDiskOperatorPrivilege privilege to the DOMAIN\Domain Admins group:

   # net rpc rights grant "DOMAIN\Domain Admins" SeDiskOperatorPrivilege -U "DOMAIN\administrator"
   Enter DOMAIN\administrator's password:
   Successfully granted rights.

   注意

   In a domain environment, grant SeDiskOperatorPrivilege to a domain group. This enables you to centrally manage the privilege by updating a user’s group membership.

2. To list all users and groups having SeDiskOperatorPrivilege granted:

   # net rpc rights list privileges SeDiskOperatorPrivilege -U "DOMAIN\administrator"
   Enter administrator's password:
   SeDiskOperatorPrivilege:
     BUILTIN\Administrators
     DOMAIN\Domain Admins

Procedure

1. To enable it globally for all shares, add the following settings to the [global] section of the /etc/samba/smb.conf file:

   vfs objects = acl_xattr
   map acl inherit = yes
   store dos attributes = yes

   Alternatively, you can enable Windows ACL support for individual shares, by adding the same parameters to a share’s section instead.

2. Restart the smb service:

   # systemctl restart smb

Procedure

1. Create the folder if it does not exist. For example:

   # mkdir -p /srv/samba/example/

2. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   # semanage fcontext -a -t samba_share_t "/srv/samba/example(/.*)?"
   # restorecon -Rv /srv/samba/example/

3. Add the example share to the /etc/samba/smb.conf file. For example, to add the share write-enabled:

   [example]
   	path = /srv/samba/example/
   	read only = no

   注意

   Regardless of the file system ACLs; if you do not set read only = no, Samba shares the directory in read-only mode.

4. If you have not enabled Windows ACL support in the [global] section for all shares, add the following parameters to the [example] section to enable this feature for this share:

   vfs objects = acl_xattr
   map acl inherit = yes
   store dos attributes = yes

5. Verify the /etc/samba/smb.conf file:

   # testparm

6. Open the required ports and reload the firewall configuration using the firewall-cmd utility:

   # firewall-cmd --permanent --add-service=samba
   # firewall-cmd --reload

7. Restart the smb service:

   # systemctl restart smb