Fix user permissions - implement group-based multi-user access
Problem: Users could authenticate but got "permission denied" when creating files Root cause: Shares used force_user which prevented proper multi-user access Solution: Group-based permission system - Created `sambashare` group for all Samba users - Users are automatically added to this group on configuration - Share directories get proper group ownership (chown :sambashare) - SetGID bit ensures new files inherit group ownership - Removed force_user directive for multi-user shares - All shares now use force_group=sambashare Changes in configure_user_shares(): - Creates sambashare group if it doesn't exist - Adds user to sambashare group - Sets filesystem permissions: chown -R :sambashare + chmod g+rw - Applies SetGID bit: chmod g+s - Removes force_user from share config - Sets force_group=sambashare Changes in disk share creation: - Creates sambashare group automatically - Adds detected user to sambashare - Sets proper filesystem permissions on mount - Uses force_group=sambashare instead of user's primary group - Removed force_user directive entirely Benefits: ✅ Multiple users can read/write files without permission errors ✅ Files preserve actual creator ownership (not forced) ✅ Proper Unix permissions maintained ✅ Works across reboots (group membership persists) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
parent
68ea576205
commit
63fa3c6636
2 changed files with 83 additions and 6 deletions
21
README.md
21
README.md
|
|
@ -101,7 +101,11 @@ sudo ./spravuj_sdileni.sh user-list
|
|||
```bash
|
||||
sudo ./spravuj_sdileni.sh user-access [username]
|
||||
```
|
||||
Interactively select which shares the user can access.
|
||||
Interactively select which shares the user can access. This command:
|
||||
- Adds the user to the `sambashare` group
|
||||
- Sets proper filesystem permissions (group ownership + read/write)
|
||||
- Removes single-user restrictions (`force user`) from shares
|
||||
- Enables multi-user access with proper file ownership
|
||||
|
||||
**Revoke user access from a share**:
|
||||
```bash
|
||||
|
|
@ -114,6 +118,21 @@ sudo ./spravuj_sdileni.sh user-delete [username]
|
|||
```
|
||||
Optionally removes the system user as well.
|
||||
|
||||
### How Permissions Work
|
||||
|
||||
FSA uses a group-based permission system for secure multi-user access:
|
||||
|
||||
1. **sambashare Group**: All Samba users are added to this group
|
||||
2. **Filesystem Permissions**: Share directories are owned by group `sambashare` with read/write access
|
||||
3. **SetGID Bit**: Ensures new files inherit the correct group ownership
|
||||
4. **No Force User**: Multi-user shares don't force a specific user, preserving actual file ownership
|
||||
|
||||
This means:
|
||||
- ✅ Multiple users can read/write files
|
||||
- ✅ Files show the actual creator's ownership
|
||||
- ✅ Proper Unix permissions are maintained
|
||||
- ✅ No permission denied errors
|
||||
|
||||
## Share Types
|
||||
|
||||
The script creates different types of shares:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue