setting default umask and user:group on directory

Question

I have a directory data and I need to set default umask and ownership for all directories/files (both existing and future files).

I want all files in data to have ownership root:martin ans permissions 750/640

I am aware that I can use setfacl to set default umask recursively using

setfacl -R -d -m o::--- data

and that I can use setgid bit on the directory, so that all created files have ownership root:martin

chmod -R +s data

UPDATE

Even with setfacl rules and setgid described above, this still does not work completely. I am trying to achieve the following:

When root creates new directories/files:

1. the ownership should be root:martin
2. the permissions should be 750/640

I have setgid and acl permissions set on current directory:

$ getfacl .
user::rwx
group::r-x
other::---
default:user::rwx
default:group::r-x
default:other::---

When I create new directories or files with mkdir/touch, everything works as I want to.

But when I copy files with or directories with cp or scp, then the ownership is correct, but the permissions are wrong, in a peculiar way. Example:

$ ll /tmp/ZZ/
-rw------- 1 martin martin 0  2021-Sep-15  05:27  aa
-rw-r--r-- 1 martin martin 0  2021-Sep-15  05:27  bb

When I copy these files as root to my dir, the permission on one file is correct, the other is wrong:

# cp /tmp/ZZ/* .
ll
-rw------- 1 root martin 0  2021-Sep-15  05:29  aa
-rw-r----- 1 root martin 0  2021-Sep-15  05:29  bb

Why does this not work as desired?

Answer 1

Option 1: The permissions of the files inside the directory doesn't matter, blocking at the directory level is usually enough, so chmod 2750 /path-to-dir is enough.

Option 2: Use ACLs only (chmod 2750 /path-to-dir is not necessary, but make things nicer for people not used to ACLs).

setfacl -R -b -d -m o::--- -m u::rwX -m g::rX  .

note that you could set g::rwX to achieve 770/660