Sharing a sub-folder but not the parent drive

Question

Level 1

26 points

Sharing a sub-folder but not the parent drive

I am running Snow Leopard Server on an Xserve and am having a difficult time with sharing permissions. I have an external (ESATA) drive that I want to share for one set of users. A sub-folder of that drive I want to share for additional users but don't want them to be able to access the entire drive.

This seems pretty simple and using Server Admin I create the shares and drag and drop appropriate permissions.

But the end result is that unless I also give the sub-folder users permissions to see the entire drive, they can't share the sub-folder share.

It seems that the lack of permissions is propagating down from the higher level even though I've explicitly added it for the sub-folder. How do I stop this?

Posted on Jun 30, 2011 4:45 PM

Reply

Answer 1

NOYBUS Author

Level 1

26 points

Jun 30, 2011 5:14 PM in response to NOYBUS

When I use the effective permissions pane to evaluate the permissions for the user I want to grant access only to the sub-folder, it shows nothing despite explicitly giving them read+write access at that level. It seems like a deny ACL is propagating from a higher level but when I check permissions at the volume share level, there is no deny ACL at all.

Reply

Answer 2

NOYBUS Author

Level 1

26 points

Jun 30, 2011 9:23 PM in response to NOYBUS

This seems to be a fundamental problem with ACLs and not just sharing. When I remove the drive share and am just sharing the sub-folder, the same problem exists.

To clarify exactly what I am doing, I have a drive

/Volumes/Drive

I want two shares

/Volumes/Drive

/Volumes/Drive/Somefolder/SharedFolder

I want to offer some users access to SharedFolder but not the rest of the drive. Admins get access to the entire drive.

Ok, I made some progress on this. In order for a user who does not have permission to the entire drive to see the share, there has to be "Traverse Folder (Execute File) ACL permissions from the root of the folder all the way down to the shared folder. The user can then see the /Volumes/Drive share listed (as well as the SharedFolder share) but when the click on it, it is empty.

Ideal would be that the user can't even see the other shares they don't have permissions on.

Am I missing something - is there a better way to do this?

Reply