SOLVED: SMB Shares ACL settings

[lassenloop]

I have a lot of files in my shares owned by apache. While I can take ownership of them myself. I would prefer to not have to keep taking ownership. I would also like to make sure apache has unrestricted access to the files it owns.

I made a script and ran it:

Code: Select all

#!/bin/bash echo Settings all directories in /var/hda/files hierarchy to RW for ACL users setfacl -R -m group:users:rw /var/hda/files setfacl -R -d -m group:users:rw /var/hda/files echo ACL set for all shares

Unfortunately, I can no longer access any of the shares via SMB. What should I change so that I can at least revert back to what I had before?

[lassenloop]

Nevermind. I resolved it and can now read/write all apache owned files.

[bigfoot65]

Is this something that would be worth adding to the wiki? If so, would you mind doing it? We would greatly appreciate it.

[lassenloop]

I don't mind. Just first let me know if you see any problems with what I did.

I made and ran the following script:

Code: Select all

#!/bin/bash echo Settings all directories in /var/hda/files hierarchy to RW for ACL users setfacl -R -m g:users:rwx /var/hda/files/ setfacl -R -d -m g:users:rwx /var/hda/files/ echo ACL set for all shares

The users group includes apache, the user created when setting up your HDA, and Transmission (in my case).

I also modified /etc/fstab

I changed "defaults" to "defaults,acl" for each drive.

[bigfoot65]

You are more of an export that I, so I am sure this is fine. If you have a reference to tag on the wiki page, that would help too.

Since apache is part of the users group, I would not think this would be necessary. I guess that is not true.

[lassenloop]

I searched the forums a fair bit. Most of the web based apps are ran as user apache. For some reason, the files owned by apache cannot be edited through the the SMB shares. I can edit them just fine through the CLI. I found other people complaining of the same issue. One person wrote a script to resolve the issue, but it still had to be ran each time you wanted to manipulate files.

I did some research and found that ACLs were a good solution. So far, I don't see any problems caused by this. I can't think of any security issues this would create either.