So, I'm running RHEL 6.x with acls enabled, etc. and I've been fighting this ACL issue for a bit now and I can't seem to get it down.

I'm trying to make it so that:

/var/www/html/* are owned root:apache
/var/www/html/* are 644
/var/www/html/* are rw- for a group we'll call 'html-slingers'

./html's getfacl looks like this:

# file: html
# owner: root
# group: apache
# flags -s-

I would /think/ that would mean files would be created with a default of user:apache, 640 (but with an extra acl entry for html-slingers to have rw)

...and the file ends up being created /looking/ that way via getfacl, but the POSIX permissions end up being 664, and the apache group is able to write to the file (even though getfacl says group::r--

Why does this happen? Is there a way to fix or mitigate this?

Any help or advice will be greatly appreciated!

  • I tried to replicate your situation on my test system, and I had problem giving the ACL to the html-slinger group, because the dash. Removing it seems to works fine with the given ACLs. Myabe could help.
    – ludiegu
    Feb 28, 2014 at 9:11

1 Answer 1


I wrangled with this recently on a server where we wanted multiple developers to have write access to the web space without giving apache write permissions. If you think about it, the for an ACL to restrict permissions, it has to override UGOA permissions. Set your ACLs to also explicitly control apache's access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .