I want to use setfacl to set permissions to dir for the users group. I do something like this:

mkdir /Employee
chgrp employeers /Employee
setfacl -m d:g::rwx /Employee

And now, when I try to create a file (from users, who's memeber of this group) I get an error about 'No permission'.

root@debian:~# ls -la /Employee
all 8
drwxr-xr-x+  2 root employeers 4096 maj 21 14:50 .
drwxr-xr-x  23 root root       4096 maj 21 14:50 ..

What am I doing wrong?

closed as unclear what you're asking by G-Man, PersianGulf, Jeff Schaller, jimmij, Anthon May 21 '16 at 22:08

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    can you post a getfacl /Employee as well as the actual error you're getting? – Bratchley May 21 '16 at 13:36
  • 1
    Did you use exactly that order of commands? With setfacl I've observed cases where the order of commands mattered, e.g. if chmod was run after setfacl then what one might expect the chmod to have done will not apply. So we need the getfacl as Bratchley indicates. – thrig May 21 '16 at 14:45

d is an abbreviation for default. The default and actual permissions are independent. Run the setfacl command a second time without the d:, then the permissions should work as desired. I assume you want the effect of both commands.

The output of getfacl can suggest this conclusion to you, by

  1. showing default: expanded
  2. showing the original Access Control Entries which do not contain "default", indicating that there is something different about the entry you made.

In turn, the + in the output of ls -l, shows that there are ACE's, which permit accesses not otherwise expected from the basic mode (there is no way standard POSIX ACE's can deny an accesses permitted by the basic mode you see)[1]. After the second setfacl command, you will notice that the basic mode changes to rwxrwxr-x. This is because employeers is the primary group of the file, and setfacl avoids creating a duplicate entry.

[1] Windows and NFSv4 ACLs allow deny entries. Many consider this to be a complexity trap, including the manpage for nfs4_acl. Naturally this means ACL order is significant. Apparently Windows GUIs change them to a "preferred" order with explicit deny entries first, and inherited entries at the end.

Not the answer you're looking for? Browse other questions tagged or ask your own question.