mirror of
https://github.com/samba-team/samba.git
synced 2025-02-04 17:47:26 +03:00
801 lines
18 KiB
HTML
801 lines
18 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML
|
|
><HEAD
|
|
><TITLE
|
|
>UNIX Permission Bits and Windows NT Access Control Lists</TITLE
|
|
><META
|
|
NAME="GENERATOR"
|
|
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
|
|
REL="HOME"
|
|
TITLE="SAMBA Project Documentation"
|
|
HREF="samba-howto-collection.html"><LINK
|
|
REL="UP"
|
|
TITLE="Advanced Configuration"
|
|
HREF="optional.html"><LINK
|
|
REL="PREVIOUS"
|
|
TITLE="System Policies"
|
|
HREF="advancednetworkmanagement.html"><LINK
|
|
REL="NEXT"
|
|
TITLE="Group mapping HOWTO"
|
|
HREF="groupmapping.html"></HEAD
|
|
><BODY
|
|
CLASS="CHAPTER"
|
|
BGCOLOR="#FFFFFF"
|
|
TEXT="#000000"
|
|
LINK="#0000FF"
|
|
VLINK="#840084"
|
|
ALINK="#0000FF"
|
|
><DIV
|
|
CLASS="NAVHEADER"
|
|
><TABLE
|
|
SUMMARY="Header navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TH
|
|
COLSPAN="3"
|
|
ALIGN="center"
|
|
>SAMBA Project Documentation</TH
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="left"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="advancednetworkmanagement.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="80%"
|
|
ALIGN="center"
|
|
VALIGN="bottom"
|
|
></TD
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="right"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="groupmapping.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><H1
|
|
><A
|
|
NAME="UNIX-PERMISSIONS"
|
|
></A
|
|
>Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists</H1
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1663"
|
|
>11.1. Viewing and changing UNIX permissions using the NT
|
|
security dialogs</A
|
|
></H1
|
|
><P
|
|
>Windows NT clients can use their native security settings
|
|
dialog box to view and modify the underlying UNIX permissions.</P
|
|
><P
|
|
>Note that this ability is careful not to compromise
|
|
the security of the UNIX host Samba is running on, and
|
|
still obeys all the file permission rules that a Samba
|
|
administrator can set.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1667"
|
|
>11.2. How to view file security on a Samba share</A
|
|
></H1
|
|
><P
|
|
>From an NT4/2000/XP client, single-click with the right
|
|
mouse button on any file or directory in a Samba mounted
|
|
drive letter or UNC path. When the menu pops-up, click
|
|
on the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Properties</I
|
|
></SPAN
|
|
> entry at the bottom of
|
|
the menu. This brings up the file properties dialog
|
|
box. Click on the tab <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Security</I
|
|
></SPAN
|
|
> and you
|
|
will see three buttons, <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Permissions</I
|
|
></SPAN
|
|
>,
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Auditing</I
|
|
></SPAN
|
|
>, and <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Ownership</I
|
|
></SPAN
|
|
>.
|
|
The <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Auditing</I
|
|
></SPAN
|
|
> button will cause either
|
|
an error message <SPAN
|
|
CLASS="ERRORNAME"
|
|
>A requested privilege is not held
|
|
by the client</SPAN
|
|
> to appear if the user is not the
|
|
NT Administrator, or a dialog which is intended to allow an
|
|
Administrator to add auditing requirements to a file if the
|
|
user is logged on as the NT Administrator. This dialog is
|
|
non-functional with a Samba share at this time, as the only
|
|
useful button, the <B
|
|
CLASS="COMMAND"
|
|
>Add</B
|
|
> button will not currently
|
|
allow a list of users to be seen.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1678"
|
|
>11.3. Viewing file ownership</A
|
|
></H1
|
|
><P
|
|
>Clicking on the <B
|
|
CLASS="COMMAND"
|
|
>"Ownership"</B
|
|
> button
|
|
brings up a dialog box telling you who owns the given file. The
|
|
owner name will be of the form :</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>"SERVER\user (Long name)"</B
|
|
></P
|
|
><P
|
|
>Where <VAR
|
|
CLASS="REPLACEABLE"
|
|
>SERVER</VAR
|
|
> is the NetBIOS name of
|
|
the Samba server, <VAR
|
|
CLASS="REPLACEABLE"
|
|
>user</VAR
|
|
> is the user name of
|
|
the UNIX user who owns the file, and <VAR
|
|
CLASS="REPLACEABLE"
|
|
>(Long name)</VAR
|
|
>
|
|
is the descriptive string identifying the user (normally found in the
|
|
GECOS field of the UNIX password database). Click on the <B
|
|
CLASS="COMMAND"
|
|
>Close
|
|
</B
|
|
> button to remove this dialog.</P
|
|
><P
|
|
>If the parameter <VAR
|
|
CLASS="PARAMETER"
|
|
>nt acl support</VAR
|
|
>
|
|
is set to <CODE
|
|
CLASS="CONSTANT"
|
|
>false</CODE
|
|
> then the file owner will
|
|
be shown as the NT user <B
|
|
CLASS="COMMAND"
|
|
>"Everyone"</B
|
|
>.</P
|
|
><P
|
|
>The <B
|
|
CLASS="COMMAND"
|
|
>Take Ownership</B
|
|
> button will not allow
|
|
you to change the ownership of this file to yourself (clicking on
|
|
it will display a dialog box complaining that the user you are
|
|
currently logged onto the NT client cannot be found). The reason
|
|
for this is that changing the ownership of a file is a privileged
|
|
operation in UNIX, available only to the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>root</I
|
|
></SPAN
|
|
>
|
|
user. As clicking on this button causes NT to attempt to change
|
|
the ownership of a file to the current user logged into the NT
|
|
client this will not work with Samba at this time.</P
|
|
><P
|
|
>There is an NT chown command that will work with Samba
|
|
and allow a user with Administrator privilege connected
|
|
to a Samba server as root to change the ownership of
|
|
files on both a local NTFS filesystem or remote mounted NTFS
|
|
or Samba drive. This is available as part of the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Seclib
|
|
</I
|
|
></SPAN
|
|
> NT security library written by Jeremy Allison of
|
|
the Samba Team, available from the main Samba ftp site.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1698"
|
|
>11.4. Viewing file or directory permissions</A
|
|
></H1
|
|
><P
|
|
>The third button is the <B
|
|
CLASS="COMMAND"
|
|
>"Permissions"</B
|
|
>
|
|
button. Clicking on this brings up a dialog box that shows both
|
|
the permissions and the UNIX owner of the file or directory.
|
|
The owner is displayed in the form :</P
|
|
><P
|
|
><B
|
|
CLASS="COMMAND"
|
|
>"SERVER\user (Long name)"</B
|
|
></P
|
|
><P
|
|
>Where <VAR
|
|
CLASS="REPLACEABLE"
|
|
>SERVER</VAR
|
|
> is the NetBIOS name of
|
|
the Samba server, <VAR
|
|
CLASS="REPLACEABLE"
|
|
>user</VAR
|
|
> is the user name of
|
|
the UNIX user who owns the file, and <VAR
|
|
CLASS="REPLACEABLE"
|
|
>(Long name)</VAR
|
|
>
|
|
is the descriptive string identifying the user (normally found in the
|
|
GECOS field of the UNIX password database).</P
|
|
><P
|
|
>If the parameter <VAR
|
|
CLASS="PARAMETER"
|
|
>nt acl support</VAR
|
|
>
|
|
is set to <CODE
|
|
CLASS="CONSTANT"
|
|
>false</CODE
|
|
> then the file owner will
|
|
be shown as the NT user <B
|
|
CLASS="COMMAND"
|
|
>"Everyone"</B
|
|
> and the
|
|
permissions will be shown as NT "Full Control".</P
|
|
><P
|
|
>The permissions field is displayed differently for files
|
|
and directories, so I'll describe the way file permissions
|
|
are displayed first.</P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1713"
|
|
>11.4.1. File Permissions</A
|
|
></H2
|
|
><P
|
|
>The standard UNIX user/group/world triple and
|
|
the corresponding "read", "write", "execute" permissions
|
|
triples are mapped by Samba into a three element NT ACL
|
|
with the 'r', 'w', and 'x' bits mapped into the corresponding
|
|
NT permissions. The UNIX world permissions are mapped into
|
|
the global NT group <B
|
|
CLASS="COMMAND"
|
|
>Everyone</B
|
|
>, followed
|
|
by the list of permissions allowed for UNIX world. The UNIX
|
|
owner and group permissions are displayed as an NT
|
|
<B
|
|
CLASS="COMMAND"
|
|
>user</B
|
|
> icon and an NT <B
|
|
CLASS="COMMAND"
|
|
>local
|
|
group</B
|
|
> icon respectively followed by the list
|
|
of permissions allowed for the UNIX user and group.</P
|
|
><P
|
|
>As many UNIX permission sets don't map into common
|
|
NT names such as <B
|
|
CLASS="COMMAND"
|
|
>"read"</B
|
|
>, <B
|
|
CLASS="COMMAND"
|
|
> "change"</B
|
|
> or <B
|
|
CLASS="COMMAND"
|
|
>"full control"</B
|
|
> then
|
|
usually the permissions will be prefixed by the words <B
|
|
CLASS="COMMAND"
|
|
> "Special Access"</B
|
|
> in the NT display list.</P
|
|
><P
|
|
>But what happens if the file has no permissions allowed
|
|
for a particular UNIX user group or world component ? In order
|
|
to allow "no permissions" to be seen and modified then Samba
|
|
overloads the NT <B
|
|
CLASS="COMMAND"
|
|
>"Take Ownership"</B
|
|
> ACL attribute
|
|
(which has no meaning in UNIX) and reports a component with
|
|
no permissions as having the NT <B
|
|
CLASS="COMMAND"
|
|
>"O"</B
|
|
> bit set.
|
|
This was chosen of course to make it look like a zero, meaning
|
|
zero permissions. More details on the decision behind this will
|
|
be given below.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN1727"
|
|
>11.4.2. Directory Permissions</A
|
|
></H2
|
|
><P
|
|
>Directories on an NT NTFS file system have two
|
|
different sets of permissions. The first set of permissions
|
|
is the ACL set on the directory itself, this is usually displayed
|
|
in the first set of parentheses in the normal <B
|
|
CLASS="COMMAND"
|
|
>"RW"</B
|
|
>
|
|
NT style. This first set of permissions is created by Samba in
|
|
exactly the same way as normal file permissions are, described
|
|
above, and is displayed in the same way.</P
|
|
><P
|
|
>The second set of directory permissions has no real meaning
|
|
in the UNIX permissions world and represents the <B
|
|
CLASS="COMMAND"
|
|
> "inherited"</B
|
|
> permissions that any file created within
|
|
this directory would inherit.</P
|
|
><P
|
|
>Samba synthesises these inherited permissions for NT by
|
|
returning as an NT ACL the UNIX permission mode that a new file
|
|
created by Samba on this share would receive.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1734"
|
|
>11.5. Modifying file or directory permissions</A
|
|
></H1
|
|
><P
|
|
>Modifying file and directory permissions is as simple
|
|
as changing the displayed permissions in the dialog box, and
|
|
clicking the <B
|
|
CLASS="COMMAND"
|
|
>OK</B
|
|
> button. However, there are
|
|
limitations that a user needs to be aware of, and also interactions
|
|
with the standard Samba permission masks and mapping of DOS
|
|
attributes that need to also be taken into account.</P
|
|
><P
|
|
>If the parameter <VAR
|
|
CLASS="PARAMETER"
|
|
>nt acl support</VAR
|
|
>
|
|
is set to <CODE
|
|
CLASS="CONSTANT"
|
|
>false</CODE
|
|
> then any attempt to set
|
|
security permissions will fail with an <B
|
|
CLASS="COMMAND"
|
|
>"Access Denied"
|
|
</B
|
|
> message.</P
|
|
><P
|
|
>The first thing to note is that the <B
|
|
CLASS="COMMAND"
|
|
>"Add"</B
|
|
>
|
|
button will not return a list of users in Samba (it will give
|
|
an error message of <B
|
|
CLASS="COMMAND"
|
|
>"The remote procedure call failed
|
|
and did not execute"</B
|
|
>). This means that you can only
|
|
manipulate the current user/group/world permissions listed in
|
|
the dialog box. This actually works quite well as these are the
|
|
only permissions that UNIX actually has.</P
|
|
><P
|
|
>If a permission triple (either user, group, or world)
|
|
is removed from the list of permissions in the NT dialog box,
|
|
then when the <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> button is pressed it will
|
|
be applied as "no permissions" on the UNIX side. If you then
|
|
view the permissions again the "no permissions" entry will appear
|
|
as the NT <B
|
|
CLASS="COMMAND"
|
|
>"O"</B
|
|
> flag, as described above. This
|
|
allows you to add permissions back to a file or directory once
|
|
you have removed them from a triple component.</P
|
|
><P
|
|
>As UNIX supports only the "r", "w" and "x" bits of
|
|
an NT ACL then if other NT security attributes such as "Delete
|
|
access" are selected then they will be ignored when applied on
|
|
the Samba server.</P
|
|
><P
|
|
>When setting permissions on a directory the second
|
|
set of permissions (in the second set of parentheses) is
|
|
by default applied to all files within that directory. If this
|
|
is not what you want you must uncheck the <B
|
|
CLASS="COMMAND"
|
|
>"Replace
|
|
permissions on existing files"</B
|
|
> checkbox in the NT
|
|
dialog before clicking <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
>.</P
|
|
><P
|
|
>If you wish to remove all permissions from a
|
|
user/group/world component then you may either highlight the
|
|
component and click the <B
|
|
CLASS="COMMAND"
|
|
>"Remove"</B
|
|
> button,
|
|
or set the component to only have the special <B
|
|
CLASS="COMMAND"
|
|
>"Take
|
|
Ownership"</B
|
|
> permission (displayed as <B
|
|
CLASS="COMMAND"
|
|
>"O"
|
|
</B
|
|
>) highlighted.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1756"
|
|
>11.6. Interaction with the standard Samba create mask
|
|
parameters</A
|
|
></H1
|
|
><P
|
|
>There are four parameters
|
|
to control interaction with the standard Samba create mask parameters.
|
|
These are :</P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>security mask</VAR
|
|
></P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>force security mode</VAR
|
|
></P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>directory security mask</VAR
|
|
></P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>force directory security mode</VAR
|
|
></P
|
|
><P
|
|
>Once a user clicks <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to apply the
|
|
permissions Samba maps the given permissions into a user/group/world
|
|
r/w/x triple set, and then will check the changed permissions for a
|
|
file against the bits set in the <A
|
|
HREF="smb.conf.5.html#SECURITYMASK"
|
|
TARGET="_top"
|
|
>
|
|
<VAR
|
|
CLASS="PARAMETER"
|
|
>security mask</VAR
|
|
></A
|
|
> parameter. Any bits that
|
|
were changed that are not set to '1' in this parameter are left alone
|
|
in the file permissions.</P
|
|
><P
|
|
>Essentially, zero bits in the <VAR
|
|
CLASS="PARAMETER"
|
|
>security mask</VAR
|
|
>
|
|
mask may be treated as a set of bits the user is <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>not</I
|
|
></SPAN
|
|
>
|
|
allowed to change, and one bits are those the user is allowed to change.
|
|
</P
|
|
><P
|
|
>If not set explicitly this parameter is set to the same value as
|
|
the <A
|
|
HREF="smb.conf.5.html#CREATEMASK"
|
|
TARGET="_top"
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>create mask
|
|
</VAR
|
|
></A
|
|
> parameter. To allow a user to modify all the
|
|
user/group/world permissions on a file, set this parameter
|
|
to 0777.</P
|
|
><P
|
|
>Next Samba checks the changed permissions for a file against
|
|
the bits set in the <A
|
|
HREF="smb.conf.5.html#FORCESECURITYMODE"
|
|
TARGET="_top"
|
|
> <VAR
|
|
CLASS="PARAMETER"
|
|
>force security mode</VAR
|
|
></A
|
|
> parameter. Any bits
|
|
that were changed that correspond to bits set to '1' in this parameter
|
|
are forced to be set.</P
|
|
><P
|
|
>Essentially, bits set in the <VAR
|
|
CLASS="PARAMETER"
|
|
>force security mode
|
|
</VAR
|
|
> parameter may be treated as a set of bits that, when
|
|
modifying security on a file, the user has always set to be 'on'.</P
|
|
><P
|
|
>If not set explicitly this parameter is set to the same value
|
|
as the <A
|
|
HREF="smb.conf.5.html#FORCECREATEMODE"
|
|
TARGET="_top"
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>force
|
|
create mode</VAR
|
|
></A
|
|
> parameter.
|
|
To allow a user to modify all the user/group/world permissions on a file
|
|
with no restrictions set this parameter to 000.</P
|
|
><P
|
|
>The <VAR
|
|
CLASS="PARAMETER"
|
|
>security mask</VAR
|
|
> and <VAR
|
|
CLASS="PARAMETER"
|
|
>force
|
|
security mode</VAR
|
|
> parameters are applied to the change
|
|
request in that order.</P
|
|
><P
|
|
>For a directory Samba will perform the same operations as
|
|
described above for a file except using the parameter <VAR
|
|
CLASS="PARAMETER"
|
|
> directory security mask</VAR
|
|
> instead of <VAR
|
|
CLASS="PARAMETER"
|
|
>security
|
|
mask</VAR
|
|
>, and <VAR
|
|
CLASS="PARAMETER"
|
|
>force directory security mode
|
|
</VAR
|
|
> parameter instead of <VAR
|
|
CLASS="PARAMETER"
|
|
>force security mode
|
|
</VAR
|
|
>.</P
|
|
><P
|
|
>The <VAR
|
|
CLASS="PARAMETER"
|
|
>directory security mask</VAR
|
|
> parameter
|
|
by default is set to the same value as the <VAR
|
|
CLASS="PARAMETER"
|
|
>directory mask
|
|
</VAR
|
|
> parameter and the <VAR
|
|
CLASS="PARAMETER"
|
|
>force directory security
|
|
mode</VAR
|
|
> parameter by default is set to the same value as
|
|
the <VAR
|
|
CLASS="PARAMETER"
|
|
>force directory mode</VAR
|
|
> parameter. </P
|
|
><P
|
|
>In this way Samba enforces the permission restrictions that
|
|
an administrator can set on a Samba share, whilst still allowing users
|
|
to modify the permission bits within that restriction.</P
|
|
><P
|
|
>If you want to set up a share that allows users full control
|
|
in modifying the permission bits on their files and directories and
|
|
doesn't force any particular bits to be set 'on', then set the following
|
|
parameters in the <A
|
|
HREF="smb.conf.5.html"
|
|
TARGET="_top"
|
|
><TT
|
|
CLASS="FILENAME"
|
|
>smb.conf(5)
|
|
</TT
|
|
></A
|
|
> file in that share specific section :</P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>security mask = 0777</VAR
|
|
></P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>force security mode = 0</VAR
|
|
></P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>directory security mask = 0777</VAR
|
|
></P
|
|
><P
|
|
><VAR
|
|
CLASS="PARAMETER"
|
|
>force directory security mode = 0</VAR
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN1810"
|
|
>11.7. Interaction with the standard Samba file attribute
|
|
mapping</A
|
|
></H1
|
|
><P
|
|
>Samba maps some of the DOS attribute bits (such as "read
|
|
only") into the UNIX permissions of a file. This means there can
|
|
be a conflict between the permission bits set via the security
|
|
dialog and the permission bits set by the file attribute mapping.
|
|
</P
|
|
><P
|
|
>One way this can show up is if a file has no UNIX read access
|
|
for the owner it will show up as "read only" in the standard
|
|
file attributes tabbed dialog. Unfortunately this dialog is
|
|
the same one that contains the security info in another tab.</P
|
|
><P
|
|
>What this can mean is that if the owner changes the permissions
|
|
to allow themselves read access using the security dialog, clicks
|
|
<B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to get back to the standard attributes tab
|
|
dialog, and then clicks <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> on that dialog, then
|
|
NT will set the file permissions back to read-only (as that is what
|
|
the attributes still say in the dialog). This means that after setting
|
|
permissions and clicking <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to get back to the
|
|
attributes dialog you should always hit <B
|
|
CLASS="COMMAND"
|
|
>"Cancel"</B
|
|
>
|
|
rather than <B
|
|
CLASS="COMMAND"
|
|
>"OK"</B
|
|
> to ensure that your changes
|
|
are not overridden.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="NAVFOOTER"
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"><TABLE
|
|
SUMMARY="Footer navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="advancednetworkmanagement.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="samba-howto-collection.html"
|
|
ACCESSKEY="H"
|
|
>Home</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="groupmapping.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
>System Policies</TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="optional.html"
|
|
ACCESSKEY="U"
|
|
>Up</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
>Group mapping HOWTO</TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
></BODY
|
|
></HTML
|
|
> |