Question: I have successfully installed CentOS and joined it to a Windows 2003 Active Directory Domain with Winbind and Samba. We are moving one of our file servers over to CentOS. One of the things I am having trouble figuring out is assigning permissions to file shares.

In case you are curious as to how I set this up, I followed this tutorial:
<http://www.linuxmail.info/active-directory-integration-samba-centos-5/>

To give an example, say we have a share called "Shared", which we want the "Domain Users" group to be able to access and write to. Now say we have a folder inside of that share called "Secret". We only want the "Secret Agents" group to be able to read and write to that folder. It should become clear that restricting access to a subfolder of a Samba share is either impossible or difficult to set up, which is what got me into looking at using POSIX ACLs.

My first question is: Is this a good way to go about setting this up? Your first thought may be to break the "Secret" folder out onto its own share, but since in real life, we have lots and lots of subfolders inside shares with different sets of permissions, giving each differing folder its own share would become a nightmare.

My second question is: If using POSIX ACL's is a good way, then would the ACL's be left intact if files and folders were backed up and restored. Would they also be left intact if say, the server blows up and we restored those files and folders to another server?

I don't know a whole lot about POSIX ACL's. I just learned about them today. So if there are any potential problems or "catches" that you think I should know about, please include those too.

Thanks for your time

Answer: 
I have done the same on my company's file server. It seems to work. The only drawback is that Mac and Linux samba clients seem to copy the original file permissions. So I had to put a cron script to restore correct permissions.

By the way, such a script would solve you backup and restore problem. The main drawback is that it overrides permissions set by your users.
This is exactly what I've done before and it works, although it can get a little messy sometimes. When setting up the ACLs I'd recommend also setting up the directories so that files and subdirectories in them are set to be owned by the secret group, if not a dummy 'secret' user as well.

If the ACLs are backed up on back up and restore, that will depend on your backup software, but in general they are and if they are not, it may just be a flag to pass. It will be --xattrs or --acls if using GNU Tar based backup such as Amanda, possibly by default in newer versions of Tar. Assuming you're restoring on another GNU/Linux server, the attributes can be restored in place, although you'll want to make sure you have the same users/groups on the new server (ideally centralized authentication.)