Using the acl xattr VFS Module
Introduction
The acl_xattr Virtual File System (VFS) module enables you to use the fine-granular Windows Access Control Lists (ACL) on a share. For further details, see Setting up a Share Using Windows ACLs.
Samba stores the Windows ACLs in the security.NTACL extended attribute of a file or directory. Therefore, the file system of the share must support extended attributes. For details, see your operating system's and file system's documentation.
 | On a Samba Active Directory (AD) domain controller (DC), the acl_xattr module is one of the automatically globally enabled vfs objects and these MUST NOT be deactivated. You must not add it, or dfs_samba4 to your smb.conf file manually, unless you are adding another vfs object, in which case you must specify both default vfs objects along with whatever vfs object you wish to add e.g. if you wish to add the recycle vfs object, you should add vfs objects = dfs_samba4 acl_xattr recycle to the smb.conf file. |
Enabling the acl_xattr Module
On a Unix domain member you can enable the acl_xattr module either globally in the the [global] section or for individual shares in the share's section, do not add it as shown to a Samba AD DCs smb.conf file. To enable the module:
- Edit your
smb.conffile. Depending on where to enable the module, add the following entry either to the[global]or to the share's section:
vfs objects = acl_xattr
- Reload the Samba configuration:
# smbcontrol all reload-config
Additional Resources
For additional information, see the vfs_acl_xattr man page.