2

So, I'm running RHEL 6.x with acls enabled, etc. and I've been fighting this ACL issue for a bit now and I can't seem to get it down.

I'm trying to make it so that:

/var/www/html/* are owned root:apache
/var/www/html/* are 644
/var/www/html/* are rw- for a group we'll call 'html-slingers'

./html's getfacl looks like this:

# file: html
# owner: root
# group: apache
# flags -s-
user::rwx
group::r-x
group:html-slingers:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r---
default:group:html-slingers:rw-
default:mask::rw-
default:other:r--

I would /think/ that would mean files would be created with a default of user:apache, 640 (but with an extra acl entry for html-slingers to have rw)

...and the file ends up being created /looking/ that way via getfacl, but the POSIX permissions end up being 664, and the apache group is able to write to the file (even though getfacl says group::r--

Why does this happen? Is there a way to fix or mitigate this?

Any help or advice will be greatly appreciated!

  • I tried to replicate your situation on my test system, and I had problem giving the ACL to the html-slinger group, because the dash. Removing it seems to works fine with the given ACLs. Myabe could help. – ludiegu Feb 28 '14 at 9:11
0

I wrangled with this recently on a server where we wanted multiple developers to have write access to the web space without giving apache write permissions. If you think about it, the for an ACL to restrict permissions, it has to override UGOA permissions. Set your ACLs to also explicitly control apache's access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.