I have a directory data and I need to set default umask and ownership for all directories/files (both existing and future files).

I want all files in data to have ownership root:martin ans permissions 750/640

I am aware that I can use setfacl to set default umask recursively using

setfacl -R -d -m o::--- data

and that I can use setgid bit on the directory, so that all created files have ownership root:martin

chmod -R +s data


Even with setfacl rules and setgid described above, this still does not work completely. I am trying to achieve the following:

When root creates new directories/files:

  1. the ownership should be root:martin
  2. the permissions should be 750/640

I have setgid and acl permissions set on current directory:

$ getfacl .

When I create new directories or files with mkdir/touch, everything works as I want to.

But when I copy files with or directories with cp or scp, then the ownership is correct, but the permissions are wrong, in a peculiar way. Example:

$ ll /tmp/ZZ/
-rw------- 1 martin martin 0  2021-Sep-15  05:27  aa
-rw-r--r-- 1 martin martin 0  2021-Sep-15  05:27  bb

When I copy these files as root to my dir, the permission on one file is correct, the other is wrong:

# cp /tmp/ZZ/* .
-rw------- 1 root martin 0  2021-Sep-15  05:29  aa
-rw-r----- 1 root martin 0  2021-Sep-15  05:29  bb

Why does this not work as desired?

  • I don't think it would be superior in any way other then it's 1 cmd. vs. 2.
    – slm
    Mar 8 '14 at 14:18
  • AFAIK, umask is only per-process, not per-directory. Only ACLs are associated with directories.
    – Barmar
    Mar 12 '14 at 18:50

Option 1: The permissions of the files inside the directory doesn't matter, blocking at the directory level is usually enough, so chmod 2750 /path-to-dir is enough.

Option 2: Use ACLs only (chmod 2750 /path-to-dir is not necessary, but make things nicer for people not used to ACLs).

setfacl -R -b -d -m o::--- -m u::rwX -m g::rX  .

note that you could set g::rwX to achieve 770/660

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.