CIFS / Subfolder permission

[BlazeStar]

Hi guys,

Using FreeNAS-9.3-STABLE-201506292130

From various posts and guides, i figured the right way to set the Windows ACL of a CIFS share was using the Windows "security tab".

So from FreeNAS I set the ownership of the share.

Then I go into Windows Explorer "Security tab" to perfect it.

But I've been trying to set subfolder permissions and it won't let me.

For example, I want a subfolder of a share to be only accessible to a specific group, which differs from the group of the share.

When I try to do that, I get a message from Windows Security that says I can't do that because the object (the subfolder) inherits permission from its parent.

It says to deactivate the inheritance option but I have no idea where to find that.

Please help

 

[Nick2253]

https://technet.microsoft.com/en-us/library/Cc726071.aspx

Don't try to change the owner or group from what is set by FreeNAS. If you want to set fine-tuned permissions, the owner/group should be used only to administer the share, unless you have FreeNAS connected to a domain, and are directly able to assign Windows accounts to the share.

 

[BlazeStar]

FreeNAS is standalone, it is not connected to a domain.

Therefore... how should I do what I need: give different permission to a subfolder?

That's gotta be one of the most basic feature of CIFS file sharing?

 

[Nick2253]

Did you read my link? It tells you exactly how to change the inherited permissions Look for the link in there that gets you to the exact details.

The rest of my comment was just an aside on best-practices.

Don't forget that underneath the Samba/CIFS permissions lies a *nix file system. That's why you don't want to mess with the owner/group: it can cause problems in FreeNAS later. Not that it will, just that it can.

 

[BlazeStar]

https://technet.microsoft.com/en-us/library/Cc726071.aspx

I did read this link.

However it says this:

There are three recommended ways to make changes to inherited permissions:
Make the changes to the parent object where the permissions are explicitly defined, and then the child object will inherit these permissions. For more information, see Set, View, Change, or Remove Permissions on an Object.

I don't want to change the parent object permissions.

Select the Allow permission to override the inherited Deny permission.

I can't find anything that looks like "Allow permission to override the inherited Deny permission" anywhere.

Clear the Include inheritable permissions from this object's parent check box. Then you can make changes to the permissions or remove users or groups from the Permissions list. However, the object will no longer inherit permissions from the parent object.

This one I found, but I think the second option is preferable.

 

[Nick2253]

I can't find anything that looks like "Allow permission to override the inherited Deny permission" anywhere.

Lol, :p. It's saying to explicitly set an "Allow" permission to override an inherited "Deny" permission. Explicit permissions override inherited permissions.

The third option is exactly what you want to do. You want to stop an object from inheriting that objects parent's permissions. So, uncheck the box.

 

[BlazeStar]

Sorry for being such a n00b.

It does, indeed, look like what I want to do.

Thanks for your help.