Browsing Occitan (post 1500) translation

98.

sudo chgrp -R sysadmin /srv/samba/share/

99.

sudo setfacl -R -m g:qa:rx /srv/samba/share/

100.

The <application>setfacl</application> command above gives <emphasis>execute</emphasis> permissions to all files in the <filename>/srv/samba/share</filename> directory, which may or may not be desirable.

101.

A <trademark class="registered">Windows</trademark> client will show that the new file permissions are implemented. See the <application>acl</application> and <application>setfacl</application> man pages for more information on <trademark>POSIX</trademark><acronym>ACL</acronym>s.

102.

Samba AppArmor Profile

103.

<phrase>Kubuntu</phrase> comes with the <application>AppArmor</application> security module, which provides mandatory access controls. The default <application>AppArmor</application> profile for <application>Samba</application> will need to be adapted to the proper configuration. For more details on using <application>AppArmor</application>, please refer to the <ulink url="https://help.ubuntu.com/community/AppArmor"> wiki</ulink>.

104.

There are default <application>AppArmor</application> profiles for <filename>/usr/sbin/smbd</filename> and <filename>/usr/sbin/nmbd</filename>, the <application>Samba</application> daemon binaries, as part of the <application>apparmor-profiles</application> packages. To install the package from a terminal prompt, enter:

105.

sudo apt-get install apparmor-profiles

106.

This package contains profiles for several other binaries.

107.

By default the profiles for <application>smbd</application> and <application>nmbd</application> are in <emphasis>complain</emphasis> mode, allowing <application>Samba</application> to work without modifying the profile, and only logging errors. To place the <application>smbd</application> profile into <emphasis>enforce</emphasis> mode and have <application>Samba</application> work as expected, the profile will need to be modified to reflect any directories that are shared.