more fine grained access control

etc/samba/smb.conf

@@ -67,7 +67,7 @@
    read only = no
    browseable = yes
    guest ok = no
-   vfs objects = acl_xattr full_audit recycle
+   vfs objects = acl_xattr xattr_tdb full_audit recycle
    recycle:repository = .trash/%U
    recycle:keeptree = yes
    recycle:versions = yes
@@ -82,18 +82,11 @@
    full_audit:failure = pread pread_recv read sendfile offload_read_recv pwrite pwrite_recv write recvfile offload_write_recv renameat unlinkat
    full_audit:syslog = false
    valid users = @"${DOMAIN_USERS_GROUP}"
-   create mask = 0660
-   directory mask = 2770
-   force create mode = 0660
-   force directory mode = 2770
-   security mask = 0660
-   directory security mask = 0770
-   force security mode = 0660
-   force directory security mode = 0770
-   inherit permissions = yes
-   inherit acls = yes
+   xattr_tdb:file = /state/data-xattrs.tdb
+   acl_xattr:ignore system acls = yes
+   acl_xattr:default acl style = windows
    inherit owner = yes
-   nt acl support = no
+   nt acl support = yes
    hide dot files = no
    hide unreadable = yes
    access based share enum = yes