Sorry it's taken me a while to get to looking at this. I am no samba expert, but your request seems reasonable to me, unless there are such serious security concerns about such an approach to make it not reasonable. But this approach should be one which is take up with upstream. I've not yet looked to see if such an approach has been examined and rejected before. Jiri, have you played with such a change to see if it works ok, or looked into whether this type of idea has been looked into before? In any event, I really don't see us diverging from upstream by incorporating such a change.