Under the following scenario: - map system = yes - create mask set appropriately (not blocking x bit on group, e.g. 777 for sake of testing) - extended acls are set on file, including acl mask It will be impossible to clear system flag - samba will: - clear only group's x bit, when unsetting system flag - will set it for both mask and group, when setting system flag - will report whenever it's set or not basing on mask's x bit only for example, following file will report mask as set: user::rw- group::rw- or rwx mask::rwx other::rw- as unset: user::rw- group::rw- or rwx mask::rw- other::rw- In the former case, unsetting system flag will clear only group's flag, and samba will continue considering the file as a system one. The only way to clear system flag status seems to be through setfacl. Basing the decision on group's x bit only - in case of presence of extended acls - seems like a good fix, as mask shouldn't be carelessly changed (it sets upper bound of permission for all named users/groups and unnamed owning group - so it could have an adverse effect on e.g. directories for named groups).
Short update - I've tested the above with samba 3.3.5 - the behaviour is the same. More detailed description follows (OG - owning group, MK - mask): 1) when determining system flag OG's X bit setting doesn't matter, only MK's X bit determine the status of system flag. 2) when unsetting system flag, following modifications happen: OG:RWX -> RW MK:RW -> RWX OG:RWX -> RW MK:RWX -> no change OG:RW -> no change MK:RW/RWX -> no change It looks like OG's X bit is used to determine whenever to alter bits or not. If yes - OG's X is set to emulate system flag, and MK's X is always set 3) when setting system flag, following modifications happen: OG:RW -> RWX MK:RW -> RWX OG:RW -> RWX MK:RWX -> no change OG:RWX -> no change MK:RW -> no change The behaviour seems analogous to #2 - OG's X bit determines if to alter bits or not. If yes - OG's X is set to emulate system flag, and MK's X is always set --- Overally - changing #1 behaviour to rely on OG's X bit, instead of MK's would likely suffice.
Jeremy, any idea what is going on here ?