In this lesson, you will learn how to synchronize POSIX ACLs with Samba configurations to ensure that file permissions remain consistent whether a user accesses a file locally or through a network share.
The Hybrid Storage Challenge
When you share a directory via Samba, you are essentially creating a bridge between two different permission systems. Linux uses POSIX ACLs to manage local access, while Windows clients (connecting via SMB) expect to interact with their own set of access control attributes. If these systems are not synchronized, a user might be granted access to a file locally but find themselves blocked when attempting to open it from a mapped network drive.
Mapping Permissions
To maintain consistency, Samba must be instructed to map POSIX ACLs to the extended attributes that Windows clients understand. This is achieved by enabling acl_xattr in your smb.conf file. By using this module, Samba acts as a translator: it reads the POSIX ACLs on the Linux filesystem and presents them as native Windows security descriptors.
When you configure a share, you must ensure your underlying filesystem is mounted with ACL support and that the Samba share definition explicitly enables the VFS (Virtual File System) module:
[shared_folder]
path = /srv/samba/data
read only = no
# Enable ACL integration
vfs objects = acl_xattr
map acl inherit = yes
Ensuring Consistency
The map acl inherit = yes setting is crucial. It tells Samba that when a file is created via the network, it should attempt to inherit the default ACLs you previously defined for the directory hierarchy. Without this, new files created over the network might default to standard umask permissions, breaking the hierarchical security model you built using default ACLs.
When both the local filesystem and the Samba VFS layer are configured to respect ACLs, you create a "unified" security environment. Changes made to permissions via a Linux command like setfacl will immediately reflect in the Windows Security tab for remote users, and vice-versa. This integration eliminates the "split-brain" scenario where local administrators and network users see different permission sets for the same data.
Key Takeaway: Synchronizing POSIX ACLs with Samba requires the acl_xattr VFS module to ensure that Linux-level permissions are accurately mapped to the Windows clients connecting to your network shares.