I have a directory data and I need to set default umask and ownership for all directories/files (both existing and future files).

I want all files in data to have ownership root:martin ans permissions 750/640

I am aware that I can use setfacl to set default umask recursively using

setfacl -R -d -m o::--- data

and that I can use setgid bit on the directory, so that all created files have ownership root:martin

chmod -R +s data


Even with setfacl rules and setgid described above, this still does not work completely. I am trying to achieve the following:

When root creates new directories/files:

  1. the ownership should be root:martin
  2. the permissions should be 750/640

I have setgid and acl permissions set on current directory:

$ getfacl .

When I create new directories or files with mkdir/touch, everything works as I want to.

But when I copy files with or directories with cp or scp, then the ownership is correct, but the permissions are wrong, in a peculiar way. Example:

$ ll /tmp/ZZ/
-rw------- 1 martin martin 0  2021-Sep-15  05:27  aa
-rw-r--r-- 1 martin martin 0  2021-Sep-15  05:27  bb

When I copy these files as root to my dir, the permission on one file is correct, the other is wrong:

# cp /tmp/ZZ/* .
-rw------- 1 root martin 0  2021-Sep-15  05:29  aa
-rw-r----- 1 root martin 0  2021-Sep-15  05:29  bb

Why does this not work as desired?

  • I don't think it would be superior in any way other then it's 1 cmd. vs. 2.
    – slm
    Mar 8, 2014 at 14:18
  • AFAIK, umask is only per-process, not per-directory. Only ACLs are associated with directories.
    – Barmar
    Mar 12, 2014 at 18:50

1 Answer 1


Option 1: The permissions of the files inside the directory doesn't matter, blocking at the directory level is usually enough, so chmod 2750 /path-to-dir is enough.

Option 2: Use ACLs only (chmod 2750 /path-to-dir is not necessary, but make things nicer for people not used to ACLs).

setfacl -R -b -d -m o::--- -m u::rwX -m g::rX  .

note that you could set g::rwX to achieve 770/660

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .