369

I want to set a folder such that anything created within it (directories, files) inherit default permissions and group.

Lets call the group "media". And also, the folders/files created within the directory should have g+rw automatically.

3
  • 3
    Isn't that controlled by the user creating the new file/folder, and his umask?
    – Wadih M.
    Aug 27, 2010 at 15:02
  • umask does relate to permissions but I do not believe it does anything with setting a default group that is not the user him/herself.
    – Chris
    Aug 27, 2010 at 15:31
  • 1
    What OS? Tags needed. setfacl and default ACLs don't exist on AIX.
    – Amit Naidu
    Apr 25, 2013 at 4:50

5 Answers 5

394

I found it: Applying default permissions

From the article:

  1. Set the setgid bit, so that files/folder under <directory> will be created with the same group as <directory>

    chmod g+s <directory>
    
  2. Set the default ACLs for the group and other

    setfacl -d -m g::rwx /<directory>
    setfacl -d -m o::rx /<directory>
    

Next we can verify:

getfacl /<directory>

Output:

# file: ../<directory>/
# owner: <user>
# group: media
# flags: -s-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x
19
  • 5
    Yay for the sticky bit!
    – gabe.
    Aug 27, 2010 at 15:11
  • 41
    Lets not confuse gid with sticky bit.
    – Amit Naidu
    Apr 25, 2013 at 4:51
  • 12
    g+s will ensure that new content in the directory will inherit the group ownership. setfacl only changes the chmod, in your case sets the permission to o=rx Feb 12, 2014 at 12:28
  • 13
    Note that ACL must be enabled (included as one of the mount options for the mounted file system) for the file permissions to be inherited.
    – sg23
    Oct 21, 2014 at 19:29
  • 45
    You might want to consider using 'X' instead so it will only set execute permission on directories not files setfacl -d -m g::rwX /<directory> Aug 31, 2017 at 0:50
48

This is an addition to Chris' answer, it's based on my experience on my Arch Linux rig.

Using the default switch (-d) and the modify switch (-m) will only modify the default permissions but leave the existing ones intact:

setfacl -d -m g::rwx /<directory>

If you want to change folder's entire permission structure including the existing ones (you'll have to do an extra line and make it recursive with -R):

setfacl -R -m g::rwx /<directory>

Examples:

# Gives group read,write,exec permissions for currently existing files and
# folders, recursively.
setfacl -R -m g::rwx /home/limited.users/directory 

# Revokes read and write permission for everyone else in existing folder and
# subfolders.
setfacl -R -m o::x /home/limited.users/directory  

# Gives group rwx permissions by default, recursively.
setfacl -R -d -m g::rwx /home/limited.users/directory

# Revokes read, write and execute permissions for everyone else. 
setfacl -R -d -m o::--- /home/limited.users/directory

(CREDIT to markdwite in comments for the syntax of the revoke all privileges line)

2
  • 4
    To revoke group privileges (as an example): sudo setfacl -d -m g::--- /path
    – markdwhite
    Jan 26, 2017 at 8:53
  • 2
    is that just a typo specifying setfacl -R -m g::rwx /<directory> twice in your answer? Sep 2, 2017 at 11:05
4

Add yourself/logged user to www-data group, so we can work with files created by www-data server

sudo usermod -a -G www-data $USER

Needs to restart/relogin so the newly added group takes effect

cd /var/www

Add www-data as group member of html folder, and your user as owner, so we own it as well as a group member

sudo chown -R $USER:www-data html

Put your username in place of USER

Set read,write,execute permission as required, (ugo) u=user, g=group, o=others

sudo chmod 750 html

Set the GID of html, now, newly created files in html will inherit ownership permissions:

sudo chmod g+s html

This creates the default rules for newly created files/dirs within the html directory and sub directories.

sudo setfacl -R -d -m u::rwX -m g::rX -m o::000 html

Make SELinux if installed, ignore www-data context requirement so it lets allows write permissions

sudo setsebool -P httpd_unified 1

list directory to see new permissions applied

ls -ld html

Returns this

drwxrwsr-x+   3 html www-data

The trailing + signify that ACL, Access Control List, is set on the directory.

Reference: Link to forum

0

Above answer doesn't updates executable permissions, though they show so. Use chacl -r u::rwx,g::r-x,o::r-- ./

-3

Using the following command you can set default permission to a file:

chacl -R filename
2
  • 3
    How this differ from other answers? And give some examples Jul 13, 2017 at 9:21
  • 5
    Are you sure that's what it does? linux.die.net/man/1/chacl indicates that it will remove an ACL.
    – Jeff Schaller
    Jul 13, 2017 at 10:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .