4 remove accidental dupe
source | link

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::--- /home/limited.users/<directory> //revokes read, write and execute permissions for everyone else. 

(CREDIT to markdwite in comments for the synthax of the revoke all privileges line)

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::--- /home/limited.users/<directory> //revokes read, write and execute permissions for everyone else. 

(CREDIT to markdwite in comments for the synthax of the revoke all privileges line)

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::--- /home/limited.users/<directory> //revokes read, write and execute permissions for everyone else. 

(CREDIT to markdwite in comments for the synthax of the revoke all privileges line)

3 added 148 characters in body
source | link

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::x--- /home/limited.users/<directory> //revokes read, write and writeexecute permissionpermissions for everyone else. 

Note, in this scheme, others still have execute privilege(CREDIT to markdwite in that folder but since they can't read it, they can't execute, even if they know location of script. If someone find a better waycomments for the synthax of revokingthe revoke all privileges in setfacl, feel free to edit that part of my answer.line)

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else

Note, in this scheme, others still have execute privilege in that folder but since they can't read it, they can't execute, even if they know location of script. If someone find a better way of revoking all privileges in setfacl, feel free to edit that part of my answer.

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::--- /home/limited.users/<directory> //revokes read, write and execute permissions for everyone else. 

(CREDIT to markdwite in comments for the synthax of the revoke all privileges line)

2 added 4 characters in body
source | link

This is an addition to Chris' answer, usingit's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else

Note, in this scheme, others still have execute privilege in that folder but since they can't read it, they can't execute, even if they know location of script. If someone find a better way of revoking all privileges in setfacl, feel free to edit that part of my answer.

This is an addition to Chris' answer, using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else

Note, in this scheme, others still have execute privilege in that folder but since they can't read it, they can't execute, even if they know location of script. If someone find a better way of revoking all privileges in setfacl, feel free to edit that part of my answer.

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>
setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else

Note, in this scheme, others still have execute privilege in that folder but since they can't read it, they can't execute, even if they know location of script. If someone find a better way of revoking all privileges in setfacl, feel free to edit that part of my answer.

1
source | link