Fix user permissions - implement group-based multi-user access

Problem: Users could authenticate but got "permission denied" when creating files
Root cause: Shares used force_user which prevented proper multi-user access

Solution: Group-based permission system
- Created `sambashare` group for all Samba users
- Users are automatically added to this group on configuration
- Share directories get proper group ownership (chown :sambashare)
- SetGID bit ensures new files inherit group ownership
- Removed force_user directive for multi-user shares
- All shares now use force_group=sambashare

Changes in configure_user_shares():
- Creates sambashare group if it doesn't exist
- Adds user to sambashare group
- Sets filesystem permissions: chown -R :sambashare + chmod g+rw
- Applies SetGID bit: chmod g+s
- Removes force_user from share config
- Sets force_group=sambashare

Changes in disk share creation:
- Creates sambashare group automatically
- Adds detected user to sambashare
- Sets proper filesystem permissions on mount
- Uses force_group=sambashare instead of user's primary group
- Removed force_user directive entirely

Benefits:
 Multiple users can read/write files without permission errors
 Files preserve actual creator ownership (not forced)
 Proper Unix permissions maintained
 Works across reboots (group membership persists)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
mxnticek 2026-01-09 21:02:31 +01:00
parent 68ea576205
commit 63fa3c6636
2 changed files with 83 additions and 6 deletions

View file

@ -101,7 +101,11 @@ sudo ./spravuj_sdileni.sh user-list
```bash
sudo ./spravuj_sdileni.sh user-access [username]
```
Interactively select which shares the user can access.
Interactively select which shares the user can access. This command:
- Adds the user to the `sambashare` group
- Sets proper filesystem permissions (group ownership + read/write)
- Removes single-user restrictions (`force user`) from shares
- Enables multi-user access with proper file ownership
**Revoke user access from a share**:
```bash
@ -114,6 +118,21 @@ sudo ./spravuj_sdileni.sh user-delete [username]
```
Optionally removes the system user as well.
### How Permissions Work
FSA uses a group-based permission system for secure multi-user access:
1. **sambashare Group**: All Samba users are added to this group
2. **Filesystem Permissions**: Share directories are owned by group `sambashare` with read/write access
3. **SetGID Bit**: Ensures new files inherit the correct group ownership
4. **No Force User**: Multi-user shares don't force a specific user, preserving actual file ownership
This means:
- ✅ Multiple users can read/write files
- ✅ Files show the actual creator's ownership
- ✅ Proper Unix permissions are maintained
- ✅ No permission denied errors
## Share Types
The script creates different types of shares: