title: Samba 4.10 server config: using module "vfs_fruit" changes file creation mask for Mac clients, and I cannot control it
body: <p>TLDR; With <code>vfs objects = catia fruit streams_xattr</code> in my <code>smb.conf</code>, files created on the shares using Macs do not inherit permissions and get extended ACLs. </p>
  
  <h2>Background</h2>
  
  <p>I'm setting up a NAS with a Samba share for our office, which is a 50/50 macOs/Windows 10 shop. Everyone should have access to the shares using dedicated user accounts. </p>
  
  <p>I wanted to leverage the latest enhancements in Samba 4 when it comes to performance with Macs, and TimeMachine support, so I enabled the modules <code>vfs objects = catia fruit streams_xattr</code></p>
  
  <h2>Problem</h2>
  
  <p>Permissions are not inherited, and masks are not respected with these <code>vfs objects</code> set. I've tried a number of combinations of <code>force create</code>and <code>create mask</code>s, and also (as in the example below) <code>inherit permissions</code>
  Without the <code>vfs objects</code> modules set, permissions are as expected.</p>
  
  <p>My <code>smb.conf</code> (relevant excerpt):</p>
  
  <pre><code>[global]
  
     server string = %h server (Samba, Ubuntu)
     server role = standalone server
     client signing = disabled
     unix password sync = yes
     vfs objects = catia fruit streams_xattr   
     fruit:aapl = yes
     map to guest = bad user
     spotlight = yes
     unix extensions = no
     browseable = yes
     read only = no
     inherit permissions = yes
  
  [OurShare]
     path = /storage/OurShare
     valid users = @office
  </code></pre>
  
  <p><code>OurShare</code> has <code>2770</code> permissions: </p>
  
  <pre><code>ls -al /storage/OurShare
  drwxrws---  adminuser  office  4096 Oct 22 03:56
  </code></pre>
  
  <p>From a Windows machine, any new directory created in <code>OurShare</code> gets <code>drwxrws---</code>, as expected.
  However a directory created from a Mac gets <code>drwxr-xr-x+</code>, so they are not writable by the group and <em>that is the main problem here</em>.</p>
  
  <p><code>$ getfacl</code> on such a directory tells me </p>
  
  <pre><code># file: OurShare/testfile
  # owner: someuser
  # group: office
  user::rwx
  user:someuser:rwx                 #effective:r-x
  group::rwx                        #effective:r-x
  group:office:rwx                  #effective:r-x
  mask::r-x
  other::r-x
  </code></pre>
  
  <p>If I remove the modules <code>vfs objects = catia fruit streams_xattr</code> from <code>smb.conf</code>, then the permissions of files/folders created from Macs match that of those created from Windows - ie. there is no problem.</p>
  
  <p>But without these modules I loose support for <code>fruit:time machine</code> for Mac backup purposes, and <code>fruit:aapl</code>, an extension which "enhances several deficiencies when connecting from Macs" (<a href="https://www.samba.org/samba/docs/current/man-html/vfs_fruit.8.html" rel="noreferrer">man vfs fruit</a>).</p>
  
  <p>This is an Ubuntu 19.04 system, with Samba v4.10.0</p>
  
  <h2>My question</h2>
  
  <p>How can I retain these Mac optimizations in Samba, while still being able to control permissions of created files and folders from the server side?</p>
  
  <p>Thanks for all advice! This is driving me nuts</p>