Web lists-archives.com

[Samba] Allow single sub-folder access on an otherwise prohibited share - why does the solution work?




Hi list,

I have managed to grant a specific user access to a sub-folder (sub-level 3 from the share's entry point, I think) on a Samba 4 share he/she is not allowed and not able to access in total/general. I tried 2 different ways with one of them working. I'd like to discuss why that is.

For the sake of an example, let's say the share is for teaching material (exam templates, grade lists, etc.), where only a few people of our personnel have access. One person shall be granted access to a sub-folder some levels down the file system, where info material for a particular course is hosted, but ONLY that folder and its sub-folders.

This person is in the "Domain User" group but NOT in the "Teaching" group. The share can be accessed by "Domain Admins" and "Teaching" personnel only (-> via the share's Security settings; Share Permissions are set to "Full control" for "Everyone"). So usually, access is denied to that person.

Way 1 - not working:
- simply grant the person dedicated (not inherited) "Modify" permissions for the sub-folder in question

Way 2 - working:
- add the person to the "Teaching" group (which grants complete access)
- create another group - let's say "Teaching_Users_restricted" - and add the person to it; DENY this group "Full control" to the complete share's file system - so again the person does not have access to any part of the share - now grant the person dedicated (not inherited) "Modify" permissions for the sub-folder in question

Why is the second method working (and working as expected)? The only info I found on the web is that DENY takes precedence over ALLOW, which does not explain my finding, right?

Ole


--

Dr. Ole Traupe

Lab Manager

Technische Universität Berlin
Biopsychologie und Neuroergonomie
Institut für Psychologie und Arbeitswissenschaft

Biological Psychology and Neuroergonomics
Department of Psychology and Ergonomics

Postanschrift/Mail to:

TU Berlin / KWT-1
Dr. Ole Traupe
Fasanenstr. 1
10623 Berlin
GERMANY

Zimmer/Office: KWT-N, Eingang 1; 2. OG
Telefon/Phone: (+49) 030 314 79513
Fax: (+49) 030 314 79516

E-Mail:ole.traupe@xxxxxxxxxxxx
www.bpn.tu-berlin.de

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba