I am trying to set default permissions on my directory structure using acl. I would like to have following default permissions for directories and for files respectively:


but when I set default permissions for group to x only:

setfacl -R -d -m g::x my_dir

then newly created directories have my desired permissions, but newly created files have -rw------- instead of -rw-r-----. In other words, I am trying to remove r permission from directories, while preserving r permission on files.

How can I achieve this ?

  • 1
    You might want to take a look at unix.stackexchange.com/questions/88206/…, the desired permissions are different, but I think the problem and solution are the same. – StrongBad May 11 '14 at 12:18
  • @StrongBad - which of the 3 answers offers solution to my problem? – Martin Vegter May 11 '14 at 13:37
  • I think the answers say you cannot do what you want perfectly and cleanly, but I would use Gilles's answer with inotify as a work around. – StrongBad May 11 '14 at 14:05
  • when I use setfacl -R -d -m g::X my_dir, i.e. substituting X for x, I see no effect. It behaves the same as x. – Martin Vegter May 11 '14 at 14:16

Linux/Solaris ACLs don't support this. You can't set different default ACLs for files and directories.

Having directories that can be traversed but whose content cannot be listed (executable but not readable) is rarely useful. The fact that is works at all is a bit of a historical accident. Yes, it can occasionally be useful — but do you really need it? (You may want to ask this as a separate question.)

If you really need directories and files with different permissions, here are a few possibilities you can consider:

  • Have your application change ownership of the files that it creates instead of relying on intrinsic filesystem properties.
  • Make everything private by default (setfacl -d -m group:mygroup:X) and use one of the suggestions in Group+rx permission only in directories using ACL?:

    • Expose group-public files through bind mounts rather than directly.
    • Watch the tree with inotify and run setfacl on new regular files.

It seems you can't do that with neither setfacl nor umask, as they both don't seem to allow separate defaults for files and directories. See this similar question for another options. If you want to force some application to make directories without read permission and files with, you can either modify it, or try LD_PRELOAD given only a binary file (although writing a lib for that might be a bit of an overkill).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.