Q: Are ACL's working correctly with 10.11.3?

I noticed that new folders created from client computers (shares) are now owned by the creator instead of the group.

A folder can never be owned by a group.

The owner of any file/folder is always a 'user'.

Are clients using AFP or SMB ?

If SMB: Turn on ACLs for the SMB shared folders, execute this command on the server:

    sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server lock -bool YES

    sudo serveradmin stop smb

    sudo serveradmin start smb

If you still have the problem, please create a folder then check/post the permissions of the new folder and it's parent.

   ls -lde /Path/Parent/NewFolder

   ls -lde /Path/Parent

Jeff

I know it used to work... thats how the comuter biz goes:

Everything that failed worked before it failed

Apple should provide this setting as a default, but they don't.

This setting addresses your exact issue and if its not enabled then you certainly should enable it.

Open Terminal and paste this command (it changes nothing)

sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AclsEnabled -bool YES

If the command does NOT return a '1' or true, then you need to change the setting

sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AclsEnabled -bool YES

sudo serveradmin stop smb

sudo serveradmin start smb

Try it... let me know if this works.

Jeff

Only f the setting above does not fix the issue, I need a little more info:

Using an SMB client connection, create a new folder then a file inside that folder.

I need to see the permissions of the folder and test file, here's the best way (in Terminal of course)

Open Terminal and type:

sudo ls -ale

# put a space after the "-ale", but don't hit return yet.

 

# now drag the test folder into the Terminal window and you should end up with

sudo ls -ale /Path/toYour/Folder

The output will look something like this

$ sudo ls -ale /Path/ToFolder

total 0

drwxr-xr-x@  7 root        staff   238 Feb  8 09:11 .

0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit

1: group:staff allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,re adextattr,writeextattr,readsecurity,file_inherit,directory_inherit

drwx------@ 68 uptimejeff  staff  2312 Feb  8 08:56 ..

0: group:com.apple.sharepoint.group.5 allow search

-rw-r--r--@  1 uptimejeff  staff     0 Feb  8 09:11 file-1.txt

0: user:_spotlight inherited allow read,execute

1: group:staff inherited allow read,write,execute,delete,append,readattr,writeattr,readextattr,writeextattr,re adsecurity

Thats what I need to see to assist more.

Jeff

Correction to previous response:

Check the SMB/ACL Setting with:

sudo defaults read /Library/Preferences/SystemConfiguration/com.apple.smb.server AclsEnabled 

If above does not return a 1, true or yes -  then set ACLsEnabled with:

sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AclsEnabled -bool YES
sudo serveradmin stop smb
sudo serveradmin start smb

Here is apple KB article on this topic

OS X Server: When saving files on SMB shares, the permissions might be changed so that only the owner can read or write …

HI,

I know this is a few months old but I'm having a similar issue with 10.11.4.  I'm getting the same "does not exist" error when trying to read the setting.  But I'm also not sure I would need to do this.  The Server app reports that ACLs are working on my SMB shares.  And when users log in they see only the shares they are allowed to, based on the ACLs.  But when I make a new folder in one of the shares, it makes me the owner, not the owner of the enclosing folder.  But the ACLs of the newly made folder seem correct.

Would applying the above "write" command risk breaking any currently working connections/ACLs?  I'll try it to see if it fixes my problem, but I don't want to boot anyone out.

Thanks,

Jeff