15

At first I create a file and check it's standard permissions and ACL entries:

$ touch file; ls -l file; getfacl file
-rw-r--r-- 1 user user 0 Jul 30 16:26 file
# file: file
# owner: user
# group: user
user::rw-
group::r--
other::r--

Then I set the ACL mask on the file and again check it's standard permissions and ACL entries:

$ setfacl -m mask:rwx file
$ ls -l file; getfacl file
-rw-rwxr--+ 1 user user 0 Jul 30 16:26 file
# file: file
# owner: user
# group: user
user::rw-
group::r--
mask::rwx
other::r--

Note that along with ACL mask standard group permission on the file also changed.

  1. What connection does exist between ACL mask and standard group permission?
  2. What is the reason for coupling ACL mask and file group permissions? What logic does lay behind it?

The distributions in question are Debian Linux 7.6 and CentOS 7


EDIT

At this point I just wanted to share some findings of mine I came up with while researching the relations between standard file group permissions and ACL mask. Here are the empirical observations I found:

  1. The ACL mask can be changed:

    1. by directly setting it with setfacl -m m:<perms> command;
    2. by changing file group permissions with chmod command (if ACL mask is already present; it may not be present because it is optional if there are no named user or group ACL permissions on the file);
    3. by adding either named user or group ACL entry (mask will be automatically recalculated).
  2. The mask will enforce maximum access rights (if there are ACL entries with permissions present that exceed the ACL mask permissions) only if the mask is set directly by setfacl or by modification of file group permission with chmod (not auto-calculated). Any changes to ACL entries will trigger the ACL mask automatic recalculation and effectively turn off the "enforcing mode".

  3. There are a couple of side effects implicitly affecting standard file group permissions when using ACLs:

    1. Named user or group ACL entry applied to a file can change the ACL mask (increase it's permissions) and hence the effective file group permissions. For example if you, as a file owner, have "rw-r--r-- jim students" permissions set on it and you also grant rw permission to the user "jack", you'll also implicitly grant rw permissions to anyone from the "students" group.
    2. Stricter (less permissions) ACL mask can permanently remove corresponding standard file group permissions. E.g. if you have a file with rw standard file group permissions and you apply a read-only ACL mask to the file it's group permissions will decrease to read-only. Then if you remove all extended ACL entries (with setfacl -b command), the group permissions will stay read-only. This applies only to stricter ACL mask, softer ACL mask (more permissions) don't permanently alter original file group permission after it is removed.
10

It doesn't make sense if the unix file permissions disagree to the acl entry and vice versa. Accordingly, the manual page (acl(5)) says what you ask for:

CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS

The permissions defined by ACLs are a superset of the permissions specified by the file permission bits.

There is a correspondence between the file owner, group, and other permissions and specific ACL entries: the owner permissions correspond to the permissions of the ACL_USER_OBJ entry. If the ACL has an ACL_MASK entry, the group permissions correspond to the permissions of the ACL_MASK entry. Otherwise, if the ACL has no ACL_MASK entry, the group permissions correspond to the permissions of the ACL_GROUP_OBJ entry. The other permissions correspond to the permissions of the ACL_OTHER_OBJ entry.

The file owner, group, and other permissions always match the permissions of the corresponding ACL entry. Modification of the file permission bits results in the modification of the associated ACL entries, and modification of these ACL entries results in the modification of the file permission bits.

Addendum in response to the discussion:

What is the reason for coupling ACL mask and file group permissions? What logic does lay behind it?

A good explanation is here. In essence the mask is an

[...] upper bound of the permissions that any entry in the group class will grant.

This upper bound property ensures that POSIX.1 applications that are unaware of ACLs will not suddenly and unexpectedly start to grant additional permissions once ACLs are supported.

In minimal ACLs, the group class permissions are identical to the owning group permissions. In extended ACLs, the group class may contain entries for additional users or groups. This results in a problem: some of these additional entries may contain permissions that are not contained in the owning group entry, so the owning group entry permissions may differ from the group class permissions.

This problem is solved by the virtue of the mask entry. With minimal ACLs, the group class permissions map to the owning group entry permissions. With extended ACLs, the group class permissions map to the mask entry permissions, whereas the owning group entry still defines the owning group permissions. The mapping of the group class permissions is no longer constant.

  • What you're saying applies to the following getfacl output: user::rw- group::r-- other::r--. Those 3 lines would change if you use chmod command to alter standard permissions and vice versa when you execute, say getfacl -m u:someuser:rwx, the standard file permission for the file owner will change and the change will be reflected in the ls -l output. That's all true, but I don't see how it answers my question – golem Jul 30 '14 at 21:08
  • see my edit for the full story – countermode Jul 30 '14 at 21:13
  • Your edited answer says that there is a coupling between file group permissions and ACL mask by design. The question of what is the reason for coupling ACL mask and file group permissions is still on. What logic lays behind it is not clear to me. – golem Jul 31 '14 at 0:58
  • 1
    There could be sense. It depends on the definition and implementation. By definition Linux file ACL, as it is implemented now, is a superset of the standard file permissions, that is include them. So they can't "contradict". Here is a use case. If I assign rwx permissions to a "testuser" for the file with initial -rw-r--r-- 1 user user permissions, that named user ACL will be accepted, and ACL mask (along with file group permissions) will be altered to rwx as well. --- [see the next comment as a continuation] – golem Jul 31 '14 at 11:48
  • 1
    Now does rwx permissions of "testuser" contradict to file's new -rw-rwxr-- 1 user user permissions or not? How do you determine the contradiction? By comparing testuser's ACL permissions to standard file group permission? What logic led you to compare group permissions to user permissions? Aren't they different entities? Isn't it counterintuitive? It is probably obvious for you but I'm still struggling to grasp it. – golem Jul 31 '14 at 11:49
0

I finally understood what exactly is occurring when I saw this link Handling ACLs

Specifically, that masks basically take the place of, and function to replace NAMED USER and all GROUP permissions. This means if you:

  1. adjust the mask, you change the group max permissions,
  2. if you change any of the group permissions with a mask present, the mask takes the max group permissions of all group permissions
  3. group read, write and execute permissions are determined based upon the mask, if present

enter image description here

Hopefully this helps.

  • There is a very nice explanation of the mask on the page you referred (quote from section 27.3.3. A Directory with Access ACL): mask defines the maximum effective access permissions for all entries in the group class. This includes named user, named group, and owning group.. – patryk.beza Apr 30 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.