Samba Share Configuration
The Samba Share Configuration domain tests how you define shares, combine Samba controls with Unix permissions and ACLs, and use VFS modules for Windows ACL support. The exam distinguishes share-level settings from file-system permissions.
Core share controls
A share is an smb.conf section such as [finance] with path = /srv/finance. Key parameters include read only or writable, valid users, write list, invalid users, browseable, guest ok, create mask, directory mask, force group, force create mode, inherit permissions, and inherit acls. valid users = @finance permits a group; write list = @finance grants write access only to that group when the share is read-only for others.
Permissions layers
Samba access is the intersection of share permissions and Unix mode bits or POSIX ACLs. A writable share does not override a directory that is not writable by the connecting user. create mask and directory mask filter permissions requested by the client; force create mode and force group set bits or group ownership explicitly. inherit permissions makes new objects inherit from the parent directory, while inherit acls propagates ACL entries; both change how masks behave, so test with a real file.
Windows ACLs
vfs objects = acl_xattr stores NT ACLs in extended attributes and can be combined with acl_xattr:ignore system acls = yes to separate Windows ACLs from POSIX ACLs. map acl inherit = yes enables Windows-style inheritance. Use smbcacls //server/share file -U user to inspect SMB ACLs and getfacl/setfacl for POSIX ACLs.
Worked example
Share /srv/finance with group finance. Create the group, run chgrp finance /srv/finance, chmod 2770 /srv/finance, then set valid users = @finance, read only = no, create mask = 0660, directory mask = 2770, and force group = finance. Reasoning: the setgid directory keeps group ownership, the masks prevent world access, valid users limits the share, and read only = no allows writes only where Unix permissions also permit them.
Traps
Assuming read only = no bypasses Unix permissions; using guest ok without a guest account and map to guest policy; expecting browseable = no to secure a share; and enabling acl_xattr on a file system without xattr support.