254

I want to set a folder such that anything created within it (directories, files) inherit default permissions and group.

Lets call the group "media". And also, the folders/files created within the directory should have g+rw automatically.

  • 1
    Isn't that controlled by the user creating the new file/folder, and his umask? – Wadih M. Aug 27 '10 at 15:02
  • umask does relate to permissions but I do not believe it does anything with setting a default group that is not the user him/herself. – Chris Aug 27 '10 at 15:31
  • 1
    What OS? Tags needed. setfacl and default ACLs don't exist on AIX. – Amit Naidu Apr 25 '13 at 4:50
269

I found it: Applying default permissions

From the article:

chmod g+s <directory>  //set gid 
setfacl -d -m g::rwx /<directory>  //set group to rwx default 
setfacl -d -m o::rx /<directory>   //set other

Next we can verify:

getfacl /<directory>

Output:

# file: ../<directory>/
# owner: <user>
# group: media
# flags: -s-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x
  • 5
    Yay for the sticky bit! – gabe. Aug 27 '10 at 15:11
  • 22
    Lets not confuse gid with sticky bit. – Amit Naidu Apr 25 '13 at 4:51
  • 10
    g+s will ensure that new content in the directory will inherit the group ownership. setfacl only changes the chmod, in your case sets the permission to o=rx – Steen Schütt Feb 12 '14 at 12:28
  • 10
    Note that ACL must be enabled (included as one of the mount options for the mounted file system) for the file permissions to be inherited. – sg23 Oct 21 '14 at 19:29
  • 11
    You might want to consider using 'X' instead so it will only set execute permission on directories not files setfacl -d -m g::rwX /<directory> – Adrian Gunawan Aug 31 '17 at 0:50
27

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive -R:

setfacl -R -m g::rwx /<directory>

eg.

setfacl -R -m g::rwx /home/limited.users/<directory> // gives group read,write,exec permissions for currently existing files and folders, recursively
setfacl -R -m o::x /home/limited.users/<directory> //revokes read and write permission for everyone else in existing folder and subfolders 
setfacl -R -d -m g::rwx /home/limited.users/<directory> // gives group rwx permissions by default, recursively
setfacl -R -d -m o::--- /home/limited.users/<directory> //revokes read, write and execute permissions for everyone else. 

(CREDIT to markdwite in comments for the synthax of the revoke all privileges line)

  • 2
    To revoke group privileges (as an example): sudo setfacl -d -m g::--- /path – markdwhite Jan 26 '17 at 8:53
  • 1
    is that just a typo specifying setfacl -R -m g::rwx /<directory> twice in your answer? – Shane Rowatt Sep 2 '17 at 11:05
0

Add yourself/logged user to www-data group, so we can work with files created by www-data server

sudo usermod -a -G www-data $USER

Needs to restart/relogin so the newly added group takes effect

cd /var/www

Add www-data as group member of html folder, and your user as owner, so we own it as well as a group member

sudo chown -R $USER:www-data html

Put your username in place of USER

Set read,write,execute permission as required, (ugo) u=user, g=group, o=others

sudo chmod 750 html

Set the GID of html, now, newly created files in html will inherit ownership permissions:

sudo chmod g+s html

This creates the default rules for newly created files/dirs within the html directory and sub directories.

sudo setfacl -R -d -m u::rwX -m g::rX -m o::000 html

Make SELinux if installed, ignore www-data context requirement so it lets allows write permissions

sudo setsebool -P httpd_unified 1

list directory to see new permissions applied

ls -ld html

Returns this

drwxrwsr-x+   3 html www-data

The trailing + signify that ACL, Access Control List, is set on the directory.

Reference: Link to forum

-2

Using the following command you can set default permission to a file:

chacl -R filename

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.