Share Point ACL on OSX Lion Server - Posix group always takes over ACLs
- by Ben
Trying to configure a share point on a Lion Server machine.
The directory is created by the local server admin (serveradmin) and has rwxr-x--- given to it.
The serveradmin user belongs to the local staff group so
serveradmin readwrite
staff group read
Others none
We have an OD group for all the employees (Workers) . Using the Server tool we've given Full Control to the share point:
Workers Full Control
serveradmin readwrite
staff group read
Others none
We would assume that Workers could then do what they want on the share but that doesn't seem to be the case. It appears the POSIX permissions take over the ACL permissions for Worker.
If I change the staff permission to readwrite then the Workers can create a file or folder in the share point.
I would think the ACL should take over but it doesn't, posix always win, rendering ACL useless.
Furthermore if I leave the readwrite permission for staff and take Write permission away for the Workers group then the posix group still wins. Essentially the Workers ACL does absolutely nothing.
There are reports of similar problems in this Apple forum thread: https://discussions.apple.com/thread/3722901
The directory nesting fix suggested there doesn't work for us.
Has anyone had similar issues and know how to fix this?
Edit: in Workgroup Manager the employees user are set to primary group staff and given the additional OD group Workers. Changing their primary group doesn't help, it only shifts the problem onto Others taking over rights (logically)
Edit 2: Ok, this is interesting, adding OD Users to the share's ACL works totally fine
