What is true about the Samba configuration option create mask?

The create mask option in Samba is used to define the permissions for newly created files in a share. Specifically, this option allows you to dictate which permission bits will be set when files are created by clients accessing the Samba share.

When we look at the statement that cleared bits are always excluded from created files, it accurately reflects how the create mask functions. If a permission bit is not set in the create mask, it means that particular permission will not be granted to the new file, regardless of the client's request. In practice, this ensures that certain permissions can be restricted at the server level, enhancing security by limiting what rights clients can assign to newly created files.

For example, if the create mask is set to 0640, this means that the owner will have read and write permissions, the group will have read permissions, and others will have no permissions at all. Since the execute permission bit is cleared in this mask, it cannot be set on any new file created under this configuration.

Understanding the function of create mask is crucial for system administrators looking to enforce security policies and manage user permissions effectively in a Samba environment. This makes the assertion about cleared bits being excluded from created files accurate regarding how Samba interprets and applies these permission settings.