It's not possible to force samba to correctly map default ACL entries to new files. It does no difference when creating a new file and a new directory. The execute bits on a new file are always set.

Example:


relevant part of smb.conf
[sambatest]
   comment = sambatest
   path = /srv/sambatest
   public = no
   writable = yes
   read only = No
   inherit acls = yes
   store dos attributes = yes
   map archive = no
   map system = no
   map hidden = no
   map readonly = no
   wide links = no
   map acl inherit = yes




$ getfacl test/
# file: test/
# owner: root
# group: root
user::rwx
user:test:rwx
group::rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::rwx

$ touch test/linuxfile
$ getfacl test/linuxfile 
# file: test/linuxfile
# owner: root
# group: root
user::rw-
group::rwx			#effective:rw-
mask::rw-
other::rw-

$ getfacl test/windowsfile.txt            #file created from windows
# file: test/windowsfile.txt
# owner: test
# group: test
user::rwx
group::rwx
mask::rwx
other::rwx

$ mkdir test/linuxdir
$ getfacl test/linuxdir/
# file: test/linuxdir/
# owner: root
# group: root
user::rwx
group::rwx
mask::rwx
other::rwx
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::rwx

$ getfacl test/windowsdir/                  3dir created from windows
# file: test/windowsdir/
# owner: test
# group: test
user::rwx
group::rwx
mask::rwx
other::rwx
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::rwx





After setting inherit acls = no:


$ getfacl test/windowsfile.txt 
# file: test/windowsfile.txt
# owner: test
# group: test
user::rw-
group::rwx
mask::rwx
other::r--

$ getfacl test/windowsdir/
# file: test/windowsdir/
# owner: test
# group: test
user::rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::rwx



Setting create mask, mode, security mode etc. does not help for other acls than standard user, group and other.

The above example means directories are OK, but file ACLs are not correctly set.

Bug is also submitted to Debian bugtracking system as #410048.