[global]
 vfs object             = recycle
 recycle:keeptree       = Yes
 recycle:touch          = Yes
 recycle:versions       = Yes
# recycle:maxsize        = 0
 # 400m
 recycle:maxsize        = 300000000
 recycle:exclude        = *.tmp|*.temp|*.o|*.DS_Store|*.obj|~$*
# Запрещенные типы файлов, удалять без базару
 veto files = /*.DS_Store/Thumbs.db/
 delete veto files = Yes

 netbios name = 1_SERVER_H34
 workgroup = WORKGROUP
 server string = FileServer

 dos charset = 866
 unix charset = utf8
 display charset = cp1251
 
# interfaces = br0
# bind interfaces only = yes

 security = user
 encrypt passwords = Yes
 null passwords = Yes
 client plaintext auth = Yes

 map to guest = Bad User
 guest account = nobody
 guest ok = yes

 create mask = 0666
 directory mask = 0777

 hide dot files = yes

 public = yes

 preferred master = yes
 local master = yes
 domain master = yes
 os level = 255
 wins support = yes
# socket options = TCP_NODELAY IPTOS_LOWDELAY
 socket options = TCP_NODELAY

 wins proxy = no
 dns proxy = no
 time server = no
 load printers = no
 show add printer wizard = no
 printing = none
 printcap name = /dev/null
 disable spoolss = yes

 log level = 2
 max log size = 30000
 log file = /var/log/samba/log.%m

 include = /etc/samba/add_cfg/%m

 deadtime = 3
 strict locking = No
 delete readonly = Yes

 acl map full control = True
 #acl group control = True       # Depricated
 dos filemode = True
 
 admin users = @support, stinky

 nt acl support = yes
 # список тех, кому разрешёно ставить те самые галки,
 admin users = @support, stinky, @design, @red, verstka_01, photo_3
 # наследовать владельца (вышестоящей директории)
 inherit owner           = yes
 # наследовать ACL
 inherit acls            = yes
 # наследовать права
 inherit permissions     = yes
 # позвоялет редактору прав из винды корректно обрабатывать
 # наследуемые права
 map acl inherit         = yes
 #блокировки - иногда бывают грабли без этого пункта
# locking                 = no
# fake oplocks		 = yes
# kernel oplocks	 = yes
# oplocks		 = yes
fake oplocks		 = no
kernel oplocks		 = no
oplocks		 	 = no


и самый низ конфига
 inherit owner           = no
 inherit acls            = no
 inherit permissions     = no
 map acl inherit         = no

include = /etc/samba/add_cfg/%m

 # наследовать владельца (вышестоящей директории)
 inherit owner           = yes
....
и самый низ конфига
 inherit owner           = no

 testparm  /etc/samba/smb.conf
Load smb config files from /etc/samba/smb.conf
Can't find include file /etc/samba/add_cfg/
Processing section "[Клипарт]"
...сократил так как идёт перечисление расшаренных папок
WARNING: You have some share names that are longer than 12 characters.
These may not be accessible to some older clients.
(Eg. Windows9x, WindowsMe, and smbclient prior to Samba 3.0.)
Invalid combination of parameters for service Клипарт.                                     Level II oplocks can only be set if oplocks are also set.
...сократил так как идёт перечисление расшаренных папок и у всех один и то же ответ.

Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
        dos charset = 866
        unix charset = utf8
        display charset = cp1251
        netbios name = 1_SERVER_H34
        server string = FileServer
        map to guest = Bad User
        null passwords = Yes
        log level = 2
        log file = /var/log/samba/log.%m
        max log size = 30000
        deadtime = 3
        load printers = No
        printcap name = /dev/null
        disable spoolss = Yes
        show add printer wizard = No
        os level = 255
        preferred master = Yes
        domain master = Yes
        dns proxy = No
        wins support = Yes
        kernel oplocks = No
        recycle:exclude = *.tmp|*.temp|*.o|*.DS_Store|*.obj|~$*
        recycle:maxsize = 300000000
        recycle:versions = Yes
        recycle:touch = Yes
        recycle:keeptree = Yes
        admin users = @support, stinky, @design, @red, verstka_01, photo_3, adm_16
        create mask = 0666
        directory mask = 0777
        inherit permissions = Yes
        inherit acls = Yes
        inherit owner = Yes
        guest ok = Yes
        map acl inherit = Yes
        delete veto files = Yes
        veto files = /*.DS_Store/Thumbs.db/
        oplocks = No
        strict locking = No
        include = /etc/samba/add_cfg/
        delete readonly = Yes
        dos filemode = Yes
        vfs objects = recycle

[Клипарт]
        comment = подборка_картинок
        path = /home/samba/cliparts
        write list = @support, @photo
...далее перечисление расшаренных папок

inherit owner           = no
 inherit acls            = no
 inherit permissions     = no
 map acl inherit         = no

 getfacl samba/
# file: samba
# owner: root
# group: root
user::rwx
user:red_01:rwx
group::rwx
group:design:rwx
group:support:rwx
group:correct:rwx
mask::rwx
other::rwx
default:user::rwx
default:user:red_01:rwx
default:group::rwx
default:group:design:rwx
default:group:support:rwx
default:group:correct:rwx
default:mask::rwx
default:other::rwx


getfacl cliparts/
# file: cliparts
# owner: root
# group: root
user::rwx
user:red_01:rwx
user:support_1:rwx
group::r-x
group:design:rwx
group:support:rwx
mask::rwx
other::r-x
default:user::rwx
default:user:red_01:rwx
default:user:support_1:rwx
default:group::rwx
default:group:design:rwx
default:group:support:rwx
default:mask::rwx
default:other::rwx

...
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
...
stat64("/etc/samba/add_cfg/smbd", 0xbfb90824) = -1 ENOENT (No such file or directory)
stat64("/etc/samba/add_cfg/smbd", 0xbfb90840) = -1 ENOENT (No such file or directory)
...

red_01 полный путь до папки
red_01 полный путь до папки

#! /bin/bash
cd /root/Programm/

# Файл основных конфигураций
user_file=./files/users_acl_a
#user_file=./test_file

# Рабочий файл программы для сравнения
programm_file=./prog_file/file_users_acl_a_prog
#programm_file=./test_file_2

# Временный рабочий файл программы для работы
programm_file_temp=./temp/temp_acl_prog
#programm_file_temp=./test_file_o

# Файл логирования программы
log_file=./log/log.log
#log_file=./test_log

# Перезапуск программы
restart=./hello_menu.sh

# Ошибка
error="echo -e \e[4;31m!!ошибка в операции!!\e[0m" 

# Сравнение файлов и остановка при пустом выводе
diff -B $user_file $programm_file

if [[ "$?" == "0" ]]
	then
		echo "$(date +%Y.%m.%d\ %H:%M) error Файлы одинаковы users_acl_a" >> $log_file
		#$restart
elif [[ "$?" == "1" ]]
	then
		diff -B $user_file $programm_file | grep -e ">" -e "<" | tee $programm_file_temp >> $log_file
fi

while read line
do
	if [[ -n "$line" && "$line" = \<* ]]
	then
		USERNAME=$(echo $line | cut -f2 -d ' ')
		DIRNAME=$(echo $line | cut -f3 -d ' ')
		setfacl -R -x $USERNAME,d:$USERNAME $DIRNAME || echo "$(date +%Y.%m.%d\ %H:%M) error $USERNAME $DIRNAME не удалось удалить" >> $log_file
	elif [[ -n "$line" && "$line" = \>* ]]	
	then
		USERNAME=$(echo $line | cut -f2 -d ' ')
		DIRNAME=$(echo $line | cut -f3 -d ' ')
		setfacl -R -m $USERNAME:rx,d:$USERNAME:rx $DIRNAME || echo "$(date +%Y.%m.%d\ %H:%M) error $USERNAME $DIRNAME не удалось добавить правила доступа" >> $log_file
		find $DIRNAME \( -name "pdf" -or -name "Работа" -or -name "Исходники" \) -type d -exec setfacl -R -m $USERNAME:rwx,d:$USERNAME:rwx {} \;
	fi
done < $programm_file_temp

rm -f $programm_file_temp
mv $programm_file $programm_file.bak
cat $user_file > $programm_file

Windows не может получить доступ к "серверу"
Проверте правильность написания данного имени....

admin users = @support, stinky, @design, @red, verstka_01, photo_3

[Шрифты]
 path = /home/samba/fonts
 browseable = yes
 read only = yes
 comment = шрифты

 inherit owner           = no
 inherit acls            = no
 inherit permissions     = no
 map acl inherit         = no

 map to guest = Bad User
 guest account = nobody
 guest ok = yes

 getent group | grep nobody 

log_file=./log/log.log
./prog_file/file_users_acl_a_prog

getenforce

sudo su nobody -m -c "head /home/samba/cliparts/<ФАЙЛ>"

/usr/sbin/getenforce
Disabled

sudo su nobody -m -c "head /home/samba/cliparts/1"
su: /bin/bash: Permission denied

Disabled

       Copying the ACL of one file to another
              getfacl file1 | setfacl --set-file=- file2

getfacl 1
# file: 1
# owner: root
# group: root
user::rwx
user:red_01:rwx
user:support_1:rwx
group::rwx
group:design:rwx
group:support:rwx
mask::rwx
other::rwx

sudo su support_1 -m -c "head 1"
su: /bin/bash: Permission denied

sudo su root -m -c "head 1"
1

setfacl --test -m support_1:x /home/samba/cliparts
setfacl -m support_1:x /home/samba/cliparts

[root@fileserv samba]# mkdir test && echo test2020 > ./test/test ; chmod 777 ./test/test
[root@fileserv samba]# setfacl -R -m u:support_1:rwx,d:u:support_1:rwx test/
[root@fileserv samba]# getfacl -R test
# file: test
# owner: root
# group: root
user::rwx
user:red_01:rwx
user:support_1:rwx
group::rwx
group:design:rwx
group:support:rwx
group:correct:rwx
mask::rwx
other::rwx
default:user::rwx
default:user:red_01:rwx
default:user:support_1:rwx
default:group::rwx
default:group:design:rwx
default:group:support:rwx
default:group:correct:rwx
default:mask::rwx
default:other::rwx

# file: test/test
# owner: root
# group: root
user::rwx
user:red_01:rwx
user:support_1:rwx
group::rwx
group:design:rwx
group:support:rwx
group:correct:rwx
mask::rwx
other::rwx

[root@fileserv samba]# sudo su support_1 -m -c "head ./test/test"
su: /bin/bash: Permission denied
[root@fileserv samba]# sudo su root -m -c "head ./test/test"
test2020

[root@fileserv samba]# ls -l ./test/test
-rwxrwxrwx+ 1 root support 9 Дек 16 09:51 ./test/test
[root@fileserv samba]# sudo su root -m -c "head ./test/test"
test2020