HP-UX HB v13.00 Ch-20 - CIFS

HP-UX Handbook – Rev 13.00 Page 35 (of 40)
Chapter 20 CIFS
October 29, 2013
and hard links, UID/GID, etc.
HP CIFS Server supports viewing and changing both UNIX file permissions and VxFS (JFS)
POSIX ACLs from Windows clients. This is done through the standard Windows Explorer
interface as if changing NTFS permissions (Windows ACLs). ACL support is not an emulation
of native NTFS (like it was with Advances Server Unix), but it allows access to UNIX ACLs
through the Windows client. You cannot run Windows applications which require native NTFS
options.
The use of VxFS (JFS) POSIX ACLs requires VxFS 3.3 with disk layout version 4. This is
available as of HP-UX 11.x and is standard in HP-UX 11i. To convert a HP-UX 11.00 file
system to disklayout 4 check out the JFS Chapter in this book. POSIX ACL’s allow up to 17
settings on a file or directory. To maintain these ACLs from the shell you would use commands
like getacl() and setacl(). Currently the loopback file system (lofs) cannot handle POSIX
ACLs on directories.
With HP CIFS Server version A.01.08 and onwards, the configuration parameter nt acl
support can be set on share level basis. It was previously a global level variable to versions
prior to Samba 2.2.2 (A.01.08). The default value is yes.
nt acl support = yes
This boolean parameter controls whether smbd(8) will attempt to map UNIX permissions into
Windows access control lists or not. Setting nt acl support = yes lets users control the ACL
support on a per-share basis and there is no further special configuration needed for supporting
ACLs. For a share supporting Windows ACLs, the CIFS Server always tries to get or set POSIX
ACEs (Access Control Entries) on the UNIX file system. If the underlying file system does not
support POSIX ACLs, then the CIFS Server will use the UNIX file permissions as fallback. This
means that only three default ACEs (owner, group and everyone) can be set. Additional ACEs
will be ignored.
In order to assign ACL entries from the Windows-client:
"File properties"-dialog
"Security"-tag  "Permissions"-button
"File permissions"-dialog
"Add"-button
"List names from"-pulldown menu
select "\\sambaserver*" !!!
"Add users and groups"-dialog
"Show users"-button
The "names"-field will only list those users who are in the smbpasswd file. ACEs can only be
assigned to those users.