I'm using Openindiana (Solaris 10) containers and I want to let users upload web content over sftp. I've managed to set up internal-sftp of OpenSSH and lock user under web root. All the files under web root should be owned by sftp user but at the same time the web server should have read access to all these files. It works well by using ACL like
chmod -R A3+user:www:list_directory/read_data/execute:file_inherit/dir_inherit:allow htdocs/
But whenever user tries to chmod 777 directory to be web server writable, the directory loses its ACLs. Denying write_acl denies user to change even discretionary access control attributes.
Ideally user should upload content by sftp, web server should have read access and full access to 777 directories. Any idea on how to achieve that?