I am unable to override previously set ACL settings.

This is what it looks like:

root@ip-xxx-xxx:/srv/www# getfacl grace.staging.site.com.au/
# file: grace.staging.site.com.au/
# owner: web
# group: www-data
default:group:www-data:rwx <---------

As you can see, the default group is default:group:www-data:rwx - this setting has been applied recursively. However, each time I create a new file or directory, they're attributed to luqo33:dev:

luqo33@ip-xxx-xxx:/srv/www/grace.staging.site.com.au$ touch test_file
luqo33@ip-xxx-xxx:/srv/www/grace.staging.site.com.au$ ls -al
total 20
drwxrwxr-x+ 3 web    www-data 4096 Jun 28 19:14 .
drwxr-xr-x  5 web    www-data 4096 Jun 28 18:33 ..
drwxrwxr-x+ 2 web    www-data 4096 Jun 28 18:33 logs
-rw-rw-r--+ 1 luqo33 dev         0 Jun 28 19:14 test_file <-------

I need to make all files and directories to be owned by web:www-data. Clearly, in spite of the fact that there is default ACL for the group (www-data), it does not have any effect. What am I missing?


That's not what the default entry means on a ACL; if you look at the new file you created you'll see it already has an ACL (the + at the end of the ls output), and a getfacl test_file will show it has group:www-data:rwx associated with it.

If you want the newly created file to be owned by www-data then you need to add the setgid bit on the directory.

Without the flag, if I create a file then it's in my group:

$ ls -ld .
drwxr-xr-x 2 sweh www-data 4096 Jun 28 17:37 ./

$ touch x
$ ls -l x
-rw-r--r-- 1 sweh sweh 0 Jun 28 17:38 x

I now add the setgid bit to the directory and the new file has group ownership defaulting to www-data

$ sudo chmod g+s .
$ ls -ld .
drwxr-sr-x 2 sweh www-data 4096 Jun 28 17:38 ./

$ touch y
$ ls -l y
-rw-r--r-- 1 sweh www-data 0 Jun 28 17:38 y
  • Thanks for this great answer. Is it possible at all to achieve the g+s functionality with ACL only? – luqo33 Jun 28 '16 at 23:10
  • I don't think so; the manpage for setfacl only mentions rwx. – Stephen Harris Jun 28 '16 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.