9

I am trying to understand the difference in behaviour between FreeBSD ACLs and Linux ACLs. In particular, the inheritance mechanism for the default ACLs.

I used the following on both Debian 9.6 and FreeBSD 12:

$ cat test_acl.sh
#!/bin/sh

set -xe

mkdir storage
setfacl -d -m u::rwx,g::rwx,o::-,m::rwx storage

touch outside
cd storage
touch inside
cd ..

ls -ld outside storage storage/inside

getfacl -d storage
getfacl storage
getfacl outside
getfacl storage/inside

umask

I get the following output from Debian 9.6:

$ ./test_acl.sh
+ mkdir storage
+ setfacl -d -m u::rwx,g::rwx,o::-,m::rwx storage
+ touch outside
+ cd storage
+ touch inside
+ cd ..
+ ls -ld outside storage storage/inside
-rw-r--r--  1 aaa aaa    0 Dec 28 11:16 outside
drwxr-xr-x+ 2 aaa aaa 4096 Dec 28 11:16 storage
-rw-rw----+ 1 aaa aaa    0 Dec 28 11:16 storage/inside

+ getfacl -d storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::rwx
mask::rwx
other::---

+ getfacl storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::---

+ getfacl outside
# file: outside
# owner: aaa
# group: aaa
user::rw-
group::r--
other::r--

+ getfacl storage/inside
# file: storage/inside
# owner: aaa
# group: aaa
user::rw-
group::rwx          #effective:rw-
mask::rw-
other::---

+ umask
0022

Notice that the outside and inside files have different permissions. In particular, the outside file has -rw-r--r--, which is the default for this user and the inside file has -rw-rw----, respecting the default ACLs I assigned the storage directory.

The output of the same script on FreeBSD 12:

$ ./test_acl.sh
+ mkdir storage
+ setfacl -d -m u::rwx,g::rwx,o::-,m::rwx storage
+ touch outside
+ cd storage
+ touch inside
+ cd ..
+ ls -ld outside storage storage/inside
-rw-r--r--  1 aaa  aaa    0 Dec 28 03:16 outside
drwxr-xr-x  2 aaa  aaa  512 Dec 28 03:16 storage
-rw-r-----+ 1 aaa  aaa    0 Dec 28 03:16 storage/inside

+ getfacl -d storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::rwx
mask::rwx
other::---

+ getfacl storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::r-x
other::r-x

+ getfacl outside
# file: outside
# owner: aaa
# group: aaa
user::rw-
group::r--
other::r--

+ getfacl storage/inside
# file: storage/inside
# owner: aaa
# group: aaa
user::rw-
group::rwx      # effective: r--
mask::r--
other::---

+ umask
0022

(Note Debian's getfacl will also show the default ACLs even when not using -d where as FreeBSD does not, but I don't think the actual ACLs for storage are different.)

Here, the outside and inside files also have different permissions, but the inside file does not have the group write permission that the Debian version does, probably because the mask in Debian retained the w while the mask in FreeBSD lost the w.

Why did FreeBSD lose the w mask but Debian retained it?

6
  • 1
    What does getfacl storage show on both systems?
    – Mikel
    Dec 28, 2018 at 17:03
  • Does this work identically if you do not use sticky group bit (g+s)?
    – sebasth
    Dec 28, 2018 at 17:04
  • @Mikel I've updated the original question content to show the getfacl information.
    – Roxy
    Dec 28, 2018 at 19:22
  • @sebasth I've updated the original question to remove the setgid bit. It's irrelevant.
    – Roxy
    Dec 28, 2018 at 19:22
  • After setting ACL to storage, ls should show +, similarly I would expect getfacl output to be similar to what you got on Debian system. Did setfacl return success exit code?
    – sebasth
    Dec 29, 2018 at 18:34

1 Answer 1

1

In short I’d say (assume) they’re using umask differently.

0022 is exactly group-other unset W. You can change umask to remove write prohibition and check the result.

Citing Solaris aka SunOS manual (and comments as well) since that seems to be pretty related: "… The umask(1) will not be applied if the directory contains default ACL entries. …"

6
  • 1
    Is one right and the other wrong? Is there a standard that this is supposed to adhere to?
    – Roxy
    Dec 30, 2018 at 14:08
  • I'm not an expert on this but (ironically enough) FreeBSD's WEB man has entry for "canonical" (arguably) implementation (SunOS) that explicitly says umask should not be counted: freebsd.org/cgi/man.cgi?query=setfacl&manpath=SunOS+5.10
    – poige
    Dec 30, 2018 at 15:20
  • "… The umask(1) will not be applied if the directory contains default ACL entries. …"
    – poige
    Dec 30, 2018 at 15:22
  • FreeBSD's own man page doesn't mentioned umask, so this seems to be an under-defined behaviour. Is FreeBSD's ACL implementation supposed to work the same as SunOS?
    – Roxy
    Dec 31, 2018 at 0:45
  • Obviously it doesn't (mention) cause otherwise it'd be clearly seen contradiction between things stated and done.
    – poige
    Dec 31, 2018 at 1:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .