1

Created file1 and gave 000 permission.

[root@localhost ~]# ls -ltr file1
----------. 1 root root 0 Jan 28 08:09 file1

Gave "test" user rw permission using access control lists:

setfacl -m u:test:rw file1

file1 permission for selinux is correct

[root@localhost ~]# getfacl file1
# file: file1
# owner: root
# group: root
user::---
user:test:rw-
group::---
mask::rw-
other::---

but when i see file permission it's showing 060

[root@localhost ~]# ls -ltr file1
----rw----+ 1 root root 0 Jan 28 08:09 file1

Question : from where this 060 permission coming ?

  • there's nothing selinux related in your question -- feel free to re-edit your question but please do not put the selinux bits back in ;-) – mosvy Jan 28 at 4:21
1

For files that have acl(5) extended attributes, the 3 group bits from the file mask may have a different meaning -- they're the ACL_MASK, ie the maximum access rights that can be granted by the ACL_USER, ACL_GROUP_OBJ and ACL_GROUP permissions stored in the ACL extended attribute. Quoting from the acl(5) manpage:

There is a correspondence between the file owner, group, and other permissions and specific ACL entries: the owner permissions correspond to the permissions of the ACL_USER_OBJ entry. If the ACL has an ACL_MASK entry, the group permissions correspond to the permissions of the ACL_MASK entry. Otherwise, if the ACL has no ACL_MASK entry, the group permissions correspond to the permissions of the ACL_GROUP_OBJ entry. The other permissions correspond to the permissions of the ACL_OTHER_OBJ entry

Since you have given the test user rw permissions, and did not use the -n option of setfacl(1) ("do not recalculate the effective rights mask"), the ACL mask has been correctly set to rw.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.