Machine: suse9es-32bit(named smbgiant) 
samba:3.0.23b
client:winxp

Steps to replicate from Windows client (logged in as AD user part of
Centrify.com's Development Zone):

1. Start, Run, \\smbgiant
2. Open your home directory
3. In \\smbgiant\<AD_username>, right-click in empty area, New, select MS Word
Document. Name it permissions.doc
4. Right click on permissions.doc, Properties, Security tab.
5. Select <AD_username>, uncheck all permissions. Click OK.
6. Reopening reveals that Read is automatically/incorrectly checked.

This is NOT a problem with group nor Everyone (World).

However, changing permissions on the Unix side: chmod 242 permissions.doc
correctly changes permissions and can be verfied by ll in Unix and
permissions.doc Properties in Windows.


I saw the samba source code.The read-only permission of the file owner was forced adding.I don't know why it is.

some code:

in posix_acls.c file.

	*posix_perms |= MAP_PERM(other_ace->perms, S_IRUSR, S_IROTH);
	*posix_perms |= MAP_PERM(other_ace->perms, S_IWUSR, S_IWOTH);
	*posix_perms |= MAP_PERM(other_ace->perms, S_IXUSR, S_IXOTH);

	/* The owner must have at least read access. */

(=>in here) *posix_perms |= S_IRUSR;
	if (fsp->is_directory)
		*posix_perms |= (S_IWUSR|S_IXUSR);
--------------------------------------------------------------------------
/* Now bounce them into the S_USR space. */	
	switch(type) {
	case S_IRUSR:
		/* Ensure owner has read access. */
		pace->perms |= S_IRUSR;
		if (fsp->is_directory)                     (<===here)
			pace->perms |= (S_IWUSR|S_IXUSR);
		and_bits = unix_perms_to_acl_perms(and_bits, S_IRUSR, S_IWUSR, S_IXUSR);
		or_bits = unix_perms_to_acl_perms(or_bits, S_IRUSR, S_IWUSR, S_IXUSR);
		break;
	case S_IRGRP:
		and_bits = unix_perms_to_acl_perms(and_bits, S_IRGRP, S_IWGRP, S_IXGRP);
		or_bits = unix_perms_to_acl_perms(or_bits, S_IRGRP, S_IWGRP, S_IXGRP);