FreeBSD 14 Samba Share ACLs Do Not Match ZFS Permissions

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Users see inconsistent access rights between SMB clients and local shell.

Environment & Reproduction

Happens with mixed POSIX/NFSv4 ACL strategy on ZFS datasets.

testparm -s

Root Cause Analysis

Dataset ACL properties and Samba VFS settings are not aligned.

Quick Triage

Inspect share stanza and dataset ACL properties.

zfs get aclmode,aclinherit 

Step-by-Step Diagnosis

Compare effective ACLs from getfacl and Windows security view.

getfacl /srv/share

Solution – Primary Fix

Set compatible ZFS ACL properties and reload Samba.

sudo zfs set aclmode=passthrough aclinherit=passthrough  && sudo service samba_server restart

Solution – Alternative Approaches

Use dedicated dataset per share with standardized ACL profile.

Verification & Acceptance Criteria

ACL changes are reflected consistently across SMB and shell access.

Rollback Plan

Restore prior dataset properties and smb4.conf backup.

Prevention & Hardening

Define canonical ACL policy for all shared datasets.

Related Errors & Cross-Refs

Can overlap with idmap SID/UID mapping inconsistencies.

Related tutorial: View the step-by-step tutorial for freebsd-14.

View all freebsd-14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Samba on ZFS ACL best-practice references.