0

I've set this ACL on a directory:

root@<server_ip>:/srv/www# getfacl example.com/
# file: example.com/
# owner: web
# group: www-data
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::r-x
default:group:dev:rwx <--
default:mask::rwx
default:other::r-x

I wanted to give the dev group all access rights (rwX)

Then I want to touch a file being logged-in as a user from the dev group:

luqo33@<server_ip>:/srv/www/example.com$ groups
dev 

I get permission denied message:

luqo33@<server_ip>:/srv/www/example.com$ touch test
touch: cannot touch ‘test’: Permission denied

Why is this happening? my ACL does not seem to have effect.

3
  • The default entries only apply to objects created in the directory. They don't change access to the directory itself. Commented Jun 23, 2016 at 21:23
  • This was exactly the reason. I used Ansible to provision a server and ACL. The task I run set the ACL rules as default. In result it did not change the ACL of the root directory but would only affect new objects.
    – luqo33
    Commented Jun 23, 2016 at 21:35
  • Cool. Once you've written a playbook to do this "give a group permission to a directory and everything below it" function, could you please place it in an answer here? It would be a useful pattern for future ansible users to use. Commented Jun 24, 2016 at 11:20

1 Answer 1

0

Hmm, I can reproduce this with

setfacl -m default:group:foogrp:rwx foodir

though in that case I cannot even chdir into the directory (did the user chdir before the ACL were applied?). Is there a reason you need to use the default group? E.g. what happens after something like:

setfacl -k example.com
setfacl -m group:dev:rwx example.com

To nix the default groups thing and add an ACL for dev group access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .