From - Wed Jul 14 10:11:03 1999
Return-Path: <samba-ntdom@samba.org>
Received: from fw.ykhm.cij.co.jp (fw.ykhm.cij.co.jp [192.168.9.99])
	by kauai.ykhm.cij.co.jp (8.9.3+3.2W/3.7W/1999062813) with ESMTP id XAA06345
	for <fumiya@cij.co.jp>; Tue, 13 Jul 1999 23:25:55 +0900 (JST)
Received: by fw.ykhm.cij.co.jp (3.7W/1999020113) id XAA22203; Tue, 13 Jul 1999 23:25:53 +0900 (JST)
Received: from kong.bstc.net (kong.bstc.net [207.239.221.11])
	by fw.ykhm.cij.co.jp (8.9.3+3.2W/3.7W/1999020419) with SMTP id XAA22199
	for <fumiya@cij.co.jp>; Tue, 13 Jul 1999 23:25:50 +0900 (JST)
	(envelope-from samba-ntdom@samba.org)
Received: (qmail 31419 invoked from network); 13 Jul 1999 14:22:18 -0000
Received: from samba.anu.edu.au (150.203.164.44)
  by kong.bstc.net with SMTP; 13 Jul 1999 14:22:18 -0000
Received: from localhost ([127.0.0.1]:18863 "HELO ") by samba.anu.edu.au with SMTP id <S12863143AbPGMOVZ>; Wed, 14 Jul 1999 00:21:25 +1000
Message-Id: <51FBD4A8EFD9D111BA7300A0C927DADB5630C7@xcgmd008.md.essd.northgrum.com>
Errors-To: listproc-errors@samba.anu.edu.au
Reply-To: timothy_d_cole@md.northgrum.com
Originator: samba-ntdom@samba.org
Sender: samba-ntdom@samba.org
Precedence: bulk
From: "Cole, Timothy D." <timothy_d_cole@md.northgrum.com>
To: Multiple recipients of list SAMBA-NTDOM <samba-ntdom@samba.org>
Subject: RE: Changing file permissions from a NT box
MIME-Version: 1.0
Content-Type: text/plain
X-Listprocessor-Version: 6.0d -- ListProcessor by Anastasios Kotsikonas
X-URL: http://samba.anu.edu.au/listproc
X-Comment: Discussion of NT domain controller support in Samba
X-Mailer: Internet Mail Service (5.5.2448.0)
Date: 	Wed, 14 Jul 1999 00:21:25 +1000
X-UIDL: 29f5138411bfb45fcd62dd1caca1be70
Status: U

Unfortunately, I don't think 2.0.4b supports the necessary RPCs to enumerate
users on the local machine, such that the "Add..." dialog won't display.
Have you tried cacls?

Setting the permissions for existing ACEs are a separate issue.
Unfortunately, in 2.0.4b, the permissions that you can set/change are
limited by both the create mask and force mask, which will override even
existing permissions, which is (usually) not what you want.  I can't use CVS
from behind the firewall here, or I'd check to see if anything is in 2.0 CVS
(pre-2.0.5?) now to remedy that.

Here's a patch that fixes the permissions mangling problems at least (n.b.
it's slightly hand-edited) for us here:

diff -u3 -r samba-2.0.4.orig/source/smbd/nttrans.c
samba-2.0.4/source/smbd/nttrans.c
--- samba-2.0.4.orig/source/smbd/nttrans.c	Fri May 14 21:06:39 1999
+++ samba-2.0.4/source/smbd/nttrans.c	Tue Jun  1 14:24:55 1999
@@ -2238,6 +2238,28 @@
               fsp->fsp_name, (unsigned int)user, (unsigned int)grp,
strerror(errno) ));
         return(UNIXERROR(ERRDOS,ERRnoaccess));
       }
+
+      /*
+       * Recheck the current state of the file, which may have changed as a
result of the
+       * chgrp/chmod (suid/sgid bits, for instance)
+       */
+
+      if(fsp->is_directory) {
+        if(dos_stat(fsp->fsp_name, &sbuf) != 0) {
+          return(UNIXERROR(ERRDOS,ERRnoaccess));
+        }
+      } else {
+
+        int ret;
+    
+        if(fsp->fd_ptr == NULL)
+          ret = dos_stat(fsp->fsp_name, &sbuf);
+        else
+          ret = sys_fstat(fsp->fd_ptr->fd, &sbuf);
+    
+        if(ret != 0)
+          return(UNIXERROR(ERRDOS,ERRnoaccess));
+      }
   }
 
   /*
@@ -2249,20 +2271,10 @@
     free_sec_desc(&psd);
-
-    /*
-     * Check to see if we need to change anything.
-     */
-
-    if(fsp->is_directory) {
-
-      perms &= lp_dir_mode(SNUM(conn));
-      perms |= lp_force_dir_mode(SNUM(conn));
-
-    } else {
-
-      perms &= lp_create_mode(SNUM(conn)); 
-      perms |= lp_force_create_mode(SNUM(conn));
-
-    }
+
+    /*
+     * Preserve special bits.
+     */
+
+    perms |= sbuf.st_mode & ~0777;
 
     /*
      * Do we need to chmod ?

> -----Original Message-----
> From:	Peter Wilke [SMTP:pwilke@mgm-edv.de]
> Sent:	Tuesday, July 13, 1999 9:09
> To:	Multiple recipients of list SAMBA-NTDOM
> Subject:	Changing file permissions from a NT box
> 
> Hello,
> 
> for us it ist important to be able to change the unix file permissions
> (mode) from a NT box. So far it is possible to make the permissions
> visible (properties-->security-->permissions). I can change the
> permissions and delete entries in the list but when I say OK and open
> the permission window again, the old permissions appear again.What I
> cannot do at all ist adding somebody. That would be nice when someone
> wants to change the group of that file or directory.
> Hope, somebody can help!
> 
> Peter Wilke

