How can I use ACL to give one user control over a directory and all its contents

Question

Two users, Foo and Bar. Foo wants Bar to work on a project in Foo's home dir.

[foo]$ mkdir project
[foo]$ # Set defaults
[foo]$ setfacl -m d:u::rwx,d:g::rwx,d:o::--- project
[foo]$ # Set defaults overrides for bar
[foo]$ setfacl -m d:u:bar:rwx project
[foo]$ # Set actual acls for project dir
[foo]$ set facl -m u::rwx,g::rwx,o::--- project

Then foo starts creating files and dirs in the new project dir.

Now after ensuring that bar has permission to get to the project dir (i.e. has suitable permissions on all the parent dirs), bar has access to all these files and dirs, and can create their own, which inherit the ACL from project dir.

However, this then means that foo's project folder contains stuff owned by bar, which could might mean foo has no access. e.g.

[bar]$ # feeling annoying...
[bar]$ cd /path/to/project
[bar]$ mkdir -p -m 700 ha/ha
[bar]$ dd if=/dev/zero of=ha/ha/evil bs=1G count=10

Now foo can withdraw bar's access to the project folder, but is stuck with a 10GB file that foo can't access, nor delete!

Is there a way to ensure foo always has full rights over any files/dirs created in a particular directory?

Answer 1

With the outdated ACL proposal from 1993 that was withdrawn in 1997, there is no way to do this as bar could always change the permissions in a way that could prevent foo from being able to control things. Note that this ACL proposal did never become a standard because users have been unhappy with it from the beginning.

I recommend to use a more modern filesystem like ZFS that supports the modern ACL standard that was derived from NTFS and is now standardized in the NFSv4 definition. With NFSv4 ACLs, you are able to set up a dedicated ACL that let's foo be the only person that can control ACL definitions and with default ACLs on directories that propagate automatically, the needed permissions can be set up in a way that grant access to bar but not the permission to change the ACLs. See the chmod man page: http://schillix.sourceforge.net/man/man1/chmod.1.html for information on NFSv4 ACLs.