I am trying to understand how I can grant permissions to the owning group once POSIX ACLs have been applied to a file.
Normally, I would use
chmod g+rwx. However, that does not work when a POSIX ACL was applied via setfacl before. I am not able to access the file with a member of the owning group afterwards.
The output of getfacl shows that the owning group entry has not changed but the mask has.
[vagrant@ice01 tmp]$ umask 077 [vagrant@ice01 tmp]$ touch test [vagrant@ice01 tmp]$ ls -lisa test 1585067 0 -rw------- 1 vagrant vagrant 0 Sep 23 17:43 test [vagrant@ice01 tmp]$ setfacl -m u:icer01:rwx test [vagrant@ice01 tmp]$ chmod g+rwx test [vagrant@ice01 tmp]$ ls -lisa test 1585067 0 -rw-rwx---+ 1 vagrant vagrant 0 Sep 23 17:43 test [vagrant@ice01 tmp]$ getfacl test # file: test # owner: vagrant # group: vagrant user::rw- user:icer01:rwx group::--- mask::rwx other::---
I read this answer and it claims:
If you use the chmod(1) command to change the file group owner permissions on a file with ACL entries, either the file group owner permissions or the ACL mask are changed to the new permissions.
I read parts of the referenced IEEE 1003.1e working draft and it backs their claim.
But more importantly: I could confirm this behavior on a CentOS 6 box with an ext4 filesystem (see above).
Am I correct in assuming, that
setfacl is the only option to grant access to the owning group once an ACL has been applied?
If so, that behavior shifts reponsibility to the end-user. In the end you have to check whether ACLs are already set, before you decide whether to use