355

I want to set a folder such that anything created within it (directories, files) inherit default permissions and group.

Lets call the group "media". And also, the folders/files created within the directory should have g+rw automatically.

3
  • 3
    Isn't that controlled by the user creating the new file/folder, and his umask?
    – Wadih M.
    Aug 27, 2010 at 15:02
  • umask does relate to permissions but I do not believe it does anything with setting a default group that is not the user him/herself.
    – Chris
    Aug 27, 2010 at 15:31
  • 1
    What OS? Tags needed. setfacl and default ACLs don't exist on AIX.
    – Amit Naidu
    Apr 25, 2013 at 4:50

5 Answers 5

378

I found it: Applying default permissions

From the article:

  1. Set the setgid bit, so that files/folder under <directory> will be created with the same group as <directory>

    chmod g+s <directory>
    
  2. Set the default ACLs for the group and other

    setfacl -d -m g::rwx /<directory>
    setfacl -d -m o::rx /<directory>
    

Next we can verify:

getfacl /<directory>

Output:

# file: ../<directory>/
# owner: <user>
# group: media
# flags: -s-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x
19
  • 5
    Yay for the sticky bit!
    – gabe.
    Aug 27, 2010 at 15:11
  • 38
    Lets not confuse gid with sticky bit.
    – Amit Naidu
    Apr 25, 2013 at 4:51
  • 12
    g+s will ensure that new content in the directory will inherit the group ownership. setfacl only changes the chmod, in your case sets the permission to o=rx Feb 12, 2014 at 12:28
  • 13
    Note that ACL must be enabled (included as one of the mount options for the mounted file system) for the file permissions to be inherited.
    – sg23
    Oct 21, 2014 at 19:29
  • 39
    You might want to consider using 'X' instead so it will only set execute permission on directories not files setfacl -d -m g::rwX /<directory> Aug 31, 2017 at 0:50
45

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive with -R):

setfacl -R -m g::rwx /<directory>

Examples:

# Gives group read,write,exec permissions for currently existing files and
# folders, recursively.
setfacl -R -m g::rwx /home/limited.users/directory 

# Revokes read and write permission for everyone else in existing folder and
# subfolders.
setfacl -R -m o::x /home/limited.users/directory  

# Gives group rwx permissions by default, recursively.
setfacl -R -d -m g::rwx /home/limited.users/directory

# Revokes read, write and execute permissions for everyone else. 
setfacl -R -d -m o::--- /home/limited.users/directory

(CREDIT to markdwite in comments for the syntax of the revoke all privileges line)

2
  • 3
    To revoke group privileges (as an example): sudo setfacl -d -m g::--- /path
    – markdwhite
    Jan 26, 2017 at 8:53
  • 2
    is that just a typo specifying setfacl -R -m g::rwx /<directory> twice in your answer? Sep 2, 2017 at 11:05
3

Add yourself/logged user to www-data group, so we can work with files created by www-data server

sudo usermod -a -G www-data $USER

Needs to restart/relogin so the newly added group takes effect

cd /var/www

Add www-data as group member of html folder, and your user as owner, so we own it as well as a group member

sudo chown -R $USER:www-data html

Put your username in place of USER

Set read,write,execute permission as required, (ugo) u=user, g=group, o=others

sudo chmod 750 html

Set the GID of html, now, newly created files in html will inherit ownership permissions:

sudo chmod g+s html

This creates the default rules for newly created files/dirs within the html directory and sub directories.

sudo setfacl -R -d -m u::rwX -m g::rX -m o::000 html

Make SELinux if installed, ignore www-data context requirement so it lets allows write permissions

sudo setsebool -P httpd_unified 1

list directory to see new permissions applied

ls -ld html

Returns this

drwxrwsr-x+   3 html www-data

The trailing + signify that ACL, Access Control List, is set on the directory.

Reference: Link to forum

0

Above answer doesn't updates executable permissions, though they show so. Use chacl -r u::rwx,g::r-x,o::r-- ./

-3

Using the following command you can set default permission to a file:

chacl -R filename
2
  • 3
    How this differ from other answers? And give some examples Jul 13, 2017 at 9:21
  • 5
    Are you sure that's what it does? linux.die.net/man/1/chacl indicates that it will remove an ACL.
    – Jeff Schaller
    Jul 13, 2017 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.