Learn Samba - Filesystem: Permission ACL & Quota

#Introduction

Up to episode 10, your access control was still "coarse": valid users, groups, and simple permission bits. In the Windows world, admins are used to opening Properties → Security and setting an ACL (Access Control List) per-user per-folder — allow A to read, deny B to delete, and so on. In episode 11 we bring that precision to Linux: POSIX ACL + xattr, and we finish with per-user/group quota. The result: Windows clients edit permissions on a Samba share just like on a Windows fileshare.

#Concept: Windows ACL vs POSIX

#Two ACL Worlds

Windows NTFS stores ACLs with high granularity: read, write, execute, delete, change permissions, take ownership, and combinations of Allow/Deny. Linux POSIX ACL has three entities (owner, group, other) plus extended entries — up to 32 additional users/groups. The two aren't identical, and Samba has to translate. This is where two concepts work together:

nt acl support = yes (default): Samba accepts and applies ACL changes made by Windows clients via the SMB protocol.
The acl_xattr VFS module: stores NTFS-style ACLs in full in extended attributes (system.ntfs_acl), rather than only translating part of them. This is what keeps Windows permissions intact.

#ACL Configuration

#Enabling acl_xattr

/etc/samba/smb.conf — share with NTFS ACL

[data]
   path = /srv/data
   nt acl support = yes
   vfs objects = acl_xattr
   inherit permissions = yes

nt acl support = yes: allow Windows clients to read/modify ACLs via SMB.
vfs objects = acl_xattr: store the full NTFS ACL in xattr, without losing information when translated back and forth.
inherit permissions = yes: new folders/files inherit the parent's permissions — prevents new files from "straying" out of the folder policy.

#Filesystem Prerequisites

acl_xattr needs a filesystem that supports POSIX ACL and xattr — ext4, XFS, and Btrfs qualify (check acl and user_xattr in mount options if needed). Verify support:

Check ACL support on the mount

tune2fs -l /dev/sda1 | grep -i "default mount"
mount | grep /srv

For the share, turn off options that interfere with ACLs: don't use force user on an ACL share (it overrides the identity being ACL'd), and leave force group only when truly necessary.

Important

force user and NTFS ACL are a problematic combination: ACLs store per-identity ownership, while force user overrides the writer's identity. On shares with acl_xattr, avoid force user — let the real identity flow so ACLs work as expected. If forced, use force user only on shares without granular ACLs.

#Editing ACLs from the Linux Side

Linux admins can also set ACLs directly with setfacl/getfacl — Samba will read the results:

Grant extra access via setfacl

sudo setfacl -m u:budi:rwx /srv/data
sudo getfacl /srv/data

setfacl -m u:budi:rwx adds an ACL entry for user budi. From the Windows side, the folder now shows budi in the Security tab with the matching permissions — proof the two worlds meet.

#Per-User and Per-Group Quota

#The Filesystem Quota Concept

Quota limits disk usage: a single user can't fill the share until the disk is full and disrupt everyone. Quota is managed by the filesystem (not Samba) — Samba only forwards queries and enforcement through the quota VFS module.

#Enabling Quota on the Filesystem

For XFS:

Enable XFS quota

sudo mount -o remount,pquota /srv
sudo xfs_quota -x -c 'limit bsoft=90g bhard=100g budi' /srv

For ext4:

Enable ext4 quota

sudo tune2fs -O quota /dev/sda1
sudo setquota -u budi 90G 100G 0 0 /srv

setquota -u budi 90G 100G sets a soft limit of 90 GB and a hard limit of 100 GB for user budi. The analogue for groups: -g.

#Connecting Samba to Quota

/etc/samba/smb.conf — share with quota

[data]
   path = /srv/data
   vfs objects = quota acl_xattr

With vfs objects = quota, Windows clients opening Properties → Quota (or viewing volume info) get real quota data, and writes exceeding the hard limit are rejected by the filesystem — a user can't add a single byte past the limit.

Tip

What values are reasonable? Measure first, don't guess. du -sh /srv/data/* | sort -h gives a picture of real usage per folder; set the soft limit slightly above average and the hard limit as a safety cap. A forgiving soft limit (temporarily exceedable) gives working room, while a rigid hard limit protects the disk from one runaway user.

#Common Pitfalls

Windows permissions don't survive a reboot: the filesystem isn't mounted with acl/user_xattr options — check /etc/fstab.
getfacl shows strange names on the Windows side: winbind isn't installed/active (episode 10) — Samba needs SID → name resolution.
Quota inactive even though setquota succeeded: make sure the filesystem is mounted with quota options (pquota/usrquota) — Samba only forwards; enforcement stays with the filesystem.
xattr not stored: the filesystem doesn't support it (e.g. tmpfs/VFAT) — use ext4/XFS/Btrfs for ACL shares.

#Closing

Key takeaways:

nt acl support = yes makes Samba honor ACL changes from Windows clients.
vfs objects = acl_xattr stores the full NTFS ACL in extended attributes.
inherit permissions = yes ensures new files inherit the folder policy.
Quota is the filesystem's responsibility; Samba forwards it via the quota VFS module.
Avoid force user on shares with granular ACLs.

In episode 12 next, we'll cover recycle bin & shadow copies — the recycle VFS module as a deletion-protection trash bin, filesystem snapshots (Btrfs/LVM) with shadow_copy2, and the "Previous Versions" feature in Windows. You'll protect data from human error and delete the panic!