249

I want to set a folder such that anything created within it (directories, files) inherit default permissions and group.

Lets call the group "media". And also, the folders/files created within the directory should have g+rw automatically.

  • 1
    Isn't that controlled by the user creating the new file/folder, and his umask? – Wadih M. Aug 27 '10 at 15:02
  • umask does relate to permissions but I do not believe it does anything with setting a default group that is not the user him/herself. – Chris Aug 27 '10 at 15:31
  • 1
    What OS? Tags needed. setfacl and default ACLs don't exist on AIX. – Amit Naidu Apr 25 '13 at 4:50
258

I found it: Applying default permissions

From the article:

chmod g+s <directory>  //set gid 
setfacl -d -m g::rwx /<directory>  //set group to rwx default 
setfacl -d -m o::rx /<directory>   //set other

Next we can verify:

getfacl /<directory>

Output:

# file: ../<directory>/
# owner: <user>
# group: media
# flags: -s-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x
  • 5
    Yay for the sticky bit! – gabe. Aug 27 '10 at 15:11
  • 22
    Lets not confuse gid with sticky bit. – Amit Naidu Apr 25 '13 at 4:51
  • 10
    g+s will ensure that new content in the directory will inherit the group ownership. setfacl only changes the chmod, in your case sets the permission to o=rx – Time Sheep Feb 12 '14 at 12:28
  • 9
    Note that ACL must be enabled (included as one of the mount options for the mounted file system) for the file permissions to be inherited. – sg23 Oct 21 '14 at 19:29
  • 8
    You might want to consider using 'X' instead so it will only set execute permission on directories not files setfacl -d -m g::rwX /<directory> – Adrian Gunawan Aug 31 '17 at 0:50
27

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::--- /home/limited.users/<directory> //revokes read, write and execute permissions for everyone else. 

(CREDIT to markdwite in comments for the synthax of the revoke all privileges line)

  • 2
    To revoke group privileges (as an example): sudo setfacl -d -m g::--- /path – markdwhite Jan 26 '17 at 8:53
  • 1
    is that just a typo specifying setfacl -R -m g::rwx /<directory> twice in your answer? – Shane Rowatt Sep 2 '17 at 11:05
0

Add yourself to apache group, so we can edit files created by apache server

sudo usermod -a -G apache myusername

Needs to Logout/Relogin so the newly added group takes effect

cd /var/www

Add apache as group member of html folder, and your user as owner, so we own it as well as a group member

sudo chown -R USER:apache html

Put your username in place of USER

Give read,write,execute permission to user & group (uuugggooo) u=user, g=group, o=others

sudo chmod 775 html

Set the GID of html, now, newly created files in html will inherit ownership permissions:

sudo chmod g+s html

This creates the default rules for newly created files/dirs within the html directory and subdirectories.

sudo setfacl -R -d -m g::rwx -m o::rx html

Make SELinux ignore apache context requirement so it lets allows write permissions

sudo setsebool -P httpd_unified 1

list directory to see new permissons applied

ls -ld html

Returns this

drwxrwsr-x+   3 html apache

The trailing + signify that ACL, Access Control List, is set on the directory.

Now new files created the html folder will be available to apche and myusername as well and vice versa.

Reference: Link to forum

-2

Using the following command you can set default permission to a file:

chacl -R filename

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.