0

I've set this ACL on a directory:

root@<server_ip>:/srv/www# getfacl example.com/
# file: example.com/
# owner: web
# group: www-data
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::r-x
default:group:dev:rwx <--
default:mask::rwx
default:other::r-x

I wanted to give the dev group all access rights (rwX)

Then I want to touch a file being logged-in as a user from the dev group:

luqo33@<server_ip>:/srv/www/example.com$ groups
dev 

I get permission denied message:

luqo33@<server_ip>:/srv/www/example.com$ touch test
touch: cannot touch ‘test’: Permission denied

Why is this happening? my ACL does not seem to have effect.

  • The default entries only apply to objects created in the directory. They don't change access to the directory itself. – Mark Plotnick Jun 23 '16 at 21:23
  • This was exactly the reason. I used Ansible to provision a server and ACL. The task I run set the ACL rules as default. In result it did not change the ACL of the root directory but would only affect new objects. – luqo33 Jun 23 '16 at 21:35
  • Cool. Once you've written a playbook to do this "give a group permission to a directory and everything below it" function, could you please place it in an answer here? It would be a useful pattern for future ansible users to use. – Mark Plotnick Jun 24 '16 at 11:20
0

Hmm, I can reproduce this with

setfacl -m default:group:foogrp:rwx foodir

though in that case I cannot even chdir into the directory (did the user chdir before the ACL were applied?). Is there a reason you need to use the default group? E.g. what happens after something like:

setfacl -k example.com
setfacl -m group:dev:rwx example.com

To nix the default groups thing and add an ACL for dev group access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.