ACLs Seem to be Ignored

Try this: On the affected share point, look for a folder called .TemporaryItems (name begins with a dot, so it's hidden). This folder is used by some applications - MS Office for instance - when saving. Unfortunately, that folder probably wasn't there when the share point was empty, so Office created it for you. The catch is that, even with inheritable ACLs, an application can ask Folder Manager to create a new folder with a specific set of permissions. And that's what Office does - it creates the .TemporaryItems folder without any ACLs, even when they're set to be inherited.

You can fix this by manually changing the permissions of .TemporaryItems on the share point on your server. At the server, let's say that the share point is Projects, located at /Volumes/Data/Projects.

Here's what to do, with nobody connected to the share point:

1. Strip any existing ACLs from it: *chmod -R -N /Volumes/Data/Projects/.TemporaryItems*

2. Remove any POSIX special permissions (like sticky bits): *chmod -R 0755 /Volumes/Data/Projects/.TemporaryItems*

3. Add an ACL to the .TemporaryItems folder that grants read/write access to the necessary group. Let's say that group is designers:

*chmod -R +ai "group:designers allow readattr,readextattr,readsecurity,list,search,read,execute,*
writeattr,writeextattr,delete,deletechild,add_file,addsubdirectory,write,append,
*file inherit,directoryinherit" /Volumes/Data/Projects/.TemporaryItems*

--Gerrit

Message was edited by: Gerrit DeWitt

Message was edited by: Gerrit DeWitt

Gerrit,
great post, but question for someone to answer:

Mac - connects via SMB with a user for a shared called "private" This user has in ACL and in POSIX permission to read and write as well as the the group she belongs in for POSIX. When connecting to the share she has no access.

Mac - connects via AFP no issues.

I am guessing the info you provided would solve this issue? This user(s) is not binded to the server, just want to know if Gerrits response would solve this issue and if this is what people are having issues with.

Thanks

Have you seen my response to this question about SMB and ACLs?

http://discussions.apple.com/thread.jspa?messageID=6997760

Try setting acl check permissions = no, which should now be the default with Server 10.5.4 and later.

--Gerrit

Gerrit,
I checked and mine already says "no". I am assuming that 10.5.5, which is what I have, by default has this setting. Again this was a Mac user connecting over SMB, not a windows user connecting. I believe 10.4 and 10.5 samba is different versions correct? Which is different then the Windows XP version as well? On a further note this is a 10.4 computer connecting to a 10.5 server. Both use different versions of Samba. any further ideas?

Thanks

Hi Gerrit, can you please tell me a bit more about Folder Manager?
I've got this thread running: http://discussions.apple.com/thread.jspa?threadID=2039638
And could use some more help..