I'm using FreeBSD and ZFS (I think FreeNAS uses NFSv4 ACLs).

I want to grant access to a group of users (group name: publicfiles_rw_users) and allow them to modify, create, and delete all files and dirs within/below a directory (path: /mnt/mydata/files/publicfiles/pub), but not let them delete/rename/move the /mnt/mydata/user/publicfiles/pub directory itself, and they can't change/modify ACLs on anything (all permissions are inherited without exception).

Of course other groups will also have access, but it's the ACLs I need to manage this group, which I'm unclear about.

As background, almost everything below /mnt/mydata/user inherits ACLs from that directory, so I can see that it will need an additional ACL entry added on pub. I'm not sure if I can simply allow all other ACLs to continue inheriting as before, or what else I have to do.

What is the cleanest way to do this, with setfacl?

  • You have contradictory requirements, so the question is unanswerable. Creating and deleting files is modifying a directory, so one cannot both have the permission for the former and not have it for the latter. – JdeBP Mar 31 '18 at 10:14
  • Surely not in the sense I'm after, otherwise one could never create a directory like myftp/files/pub in which users could upload files, without also giving them permission to delete pub itself. Perhaps I should be clearer and reword - "without deleting/moving/renaming the dir". Modifying the dir only in regard to last time changed, or files it contains, isn't an issue. Question edited, does that resolve the problem? – Stilez Mar 31 '18 at 10:49
  • Yes, in the sense that you are after too. Deleting or renaming the directory pub is not the same as deleting or renaming the things in directory pub, and they are not both denoted permission to modify directory pub. It is after all, the parent of pub that is modified in the former cases. – JdeBP Mar 31 '18 at 11:13
  • This feels like miscommunication - probably on my part! Can we move to chat to clarify the mistake, so I can word the question more appropriately? My observation is that if what I want isn't possible, then granting permission to any user to create/delete/modify files in pub would necessarily imply permission to delete/move/rename pub itself... which would by the same logic necessitate permission to delete/move/rename publicfiles.... which would imply by the same logic permission to delete/rename/move files.. all the way up to /. ...... – Stilez Mar 31 '18 at 11:41
  • As that can't possibly be correct, I must be miswording the question so that what I'm asking isn't what I actually want. But comments aren't an ideal way to explore that. Can we move to chat at least to the point where the question is fixed? – Stilez Mar 31 '18 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.