Using FACLs to restrict default group but allow others

Question

So, I'm running RHEL 6.x with acls enabled, etc. and I've been fighting this ACL issue for a bit now and I can't seem to get it down.

I'm trying to make it so that:

/var/www/html/* are owned root:apache
/var/www/html/* are 644
/var/www/html/* are rw- for a group we'll call 'html-slingers'

./html's getfacl looks like this:

# file: html
# owner: root
# group: apache
# flags -s-
user::rwx
group::r-x
group:html-slingers:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r---
default:group:html-slingers:rw-
default:mask::rw-
default:other:r--

I would /think/ that would mean files would be created with a default of user:apache, 640 (but with an extra acl entry for html-slingers to have rw)

...and the file ends up being created /looking/ that way via getfacl, but the POSIX permissions end up being 664, and the apache group is able to write to the file (even though getfacl says group::r--

Why does this happen? Is there a way to fix or mitigate this?

Any help or advice will be greatly appreciated!

Answer 1

I wrangled with this recently on a server where we wanted multiple developers to have write access to the web space without giving apache write permissions. If you think about it, the for an ACL to restrict permissions, it has to override UGOA permissions. Set your ACLs to also explicitly control apache's access.