10

I am trying to understand the difference in behaviour between FreeBSD ACLs and Linux ACLs. In particular, the inheritance mechanism for the default ACLs.

I used the following on both Debian 9.6 and FreeBSD 12:

$ cat test_acl.sh
#!/bin/sh

set -xe

mkdir storage
setfacl -d -m u::rwx,g::rwx,o::-,m::rwx storage

touch outside
cd storage
touch inside
cd ..

ls -ld outside storage storage/inside

getfacl -d storage
getfacl storage
getfacl outside
getfacl storage/inside

umask

I get the following output from Debian 9.6:

$ ./test_acl.sh
+ mkdir storage
+ setfacl -d -m u::rwx,g::rwx,o::-,m::rwx storage
+ touch outside
+ cd storage
+ touch inside
+ cd ..
+ ls -ld outside storage storage/inside
-rw-r--r--  1 aaa aaa    0 Dec 28 11:16 outside
drwxr-xr-x+ 2 aaa aaa 4096 Dec 28 11:16 storage
-rw-rw----+ 1 aaa aaa    0 Dec 28 11:16 storage/inside

+ getfacl -d storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::rwx
mask::rwx
other::---

+ getfacl storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::---

+ getfacl outside
# file: outside
# owner: aaa
# group: aaa
user::rw-
group::r--
other::r--

+ getfacl storage/inside
# file: storage/inside
# owner: aaa
# group: aaa
user::rw-
group::rwx          #effective:rw-
mask::rw-
other::---

+ umask
0022

Notice that the outside and inside files have different permissions. In particular, the outside file has -rw-r--r--, which is the default for this user and the inside file has -rw-rw----, respecting the default ACLs I assigned the storage directory.

The output of the same script on FreeBSD 12:

$ ./test_acl.sh
+ mkdir storage
+ setfacl -d -m u::rwx,g::rwx,o::-,m::rwx storage
+ touch outside
+ cd storage
+ touch inside
+ cd ..
+ ls -ld outside storage storage/inside
-rw-r--r--  1 aaa  aaa    0 Dec 28 03:16 outside
drwxr-xr-x  2 aaa  aaa  512 Dec 28 03:16 storage
-rw-r-----+ 1 aaa  aaa    0 Dec 28 03:16 storage/inside

+ getfacl -d storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::rwx
mask::rwx
other::---

+ getfacl storage
# file: storage
# owner: aaa
# group: aaa
user::rwx
group::r-x
other::r-x

+ getfacl outside
# file: outside
# owner: aaa
# group: aaa
user::rw-
group::r--
other::r--

+ getfacl storage/inside
# file: storage/inside
# owner: aaa
# group: aaa
user::rw-
group::rwx      # effective: r--
mask::r--
other::---

+ umask
0022

(Note Debian's getfacl will also show the default ACLs even when not using -d where as FreeBSD does not, but I don't think the actual ACLs for storage are different.)

Here, the outside and inside files also have different permissions, but the inside file does not have the group write permission that the Debian version does, probably because the mask in Debian retained the w while the mask in FreeBSD lost the w.

Why did FreeBSD lose the w mask but Debian retained it?

  • 1
    What does getfacl storage show on both systems? – Mikel Dec 28 '18 at 17:03
  • Does this work identically if you do not use sticky group bit (g+s)? – sebasth Dec 28 '18 at 17:04
  • @Mikel I've updated the original question content to show the getfacl information. – Roxy Dec 28 '18 at 19:22
  • @sebasth I've updated the original question to remove the setgid bit. It's irrelevant. – Roxy Dec 28 '18 at 19:22
  • After setting ACL to storage, ls should show +, similarly I would expect getfacl output to be similar to what you got on Debian system. Did setfacl return success exit code? – sebasth Dec 29 '18 at 18:34
1

In short I’d say (assume) they’re using umask differently.

0022 is exactly group-other unset W. You can change umask to remove write prohibition and check the result.

Citing Solaris aka SunOS manual (and comments as well) since that seems to be pretty related: "… The umask(1) will not be applied if the directory contains default ACL entries. …"

  • 1
    Is one right and the other wrong? Is there a standard that this is supposed to adhere to? – Roxy Dec 30 '18 at 14:08
  • I'm not an expert on this but (ironically enough) FreeBSD's WEB man has entry for "canonical" (arguably) implementation (SunOS) that explicitly says umask should not be counted: freebsd.org/cgi/man.cgi?query=setfacl&manpath=SunOS+5.10 – poige Dec 30 '18 at 15:20
  • "… The umask(1) will not be applied if the directory contains default ACL entries. …" – poige Dec 30 '18 at 15:22
  • FreeBSD's own man page doesn't mentioned umask, so this seems to be an under-defined behaviour. Is FreeBSD's ACL implementation supposed to work the same as SunOS? – Roxy Dec 31 '18 at 0:45
  • Obviously it doesn't (mention) cause otherwise it'd be clearly seen contradiction between things stated and done. – poige Dec 31 '18 at 1:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.