0

Note: to clarify the question, I am assuming an empty directory to start; I realize if it was non-empty I could use the -R option to setfacl.

Here's what I tried (wanting to give access of /tmp/badDir to user me, when it was created and owned by otheruser):

$ sudo -u otheruser mkdir /tmp/badDir
$ sudo setfacl -dm "user:me:rwX" /tmp/badDir
$ sudo -u otheruser touch /tmp/badDir/baz
$ touch /tmp/badDir/baz

So at first glance this looks good.

But then if I try certain other operations that I need, it isn't what I expect:

$ touch /tmp/badDir
touch: setting times of '/tmp/badDir': Permission denied
$ touch /tmp/badDir/foo
touch: cannot touch '/tmp/badDir/foo': Permission denied

So it looks like I can't modify the directory metadata or create files within the directory, though I can modify files within the directory created by the user otheruser.

Output of ls and getfacl is:

$ ls -last /tmp/badDir
total 0
0 drwxrwxrwt  1 root     root     1794 Jun 22 09:22 ..
0 -rw-rw-r--+ 1 otheruser otheruser    0 Jun 22 09:22 baz
0 drwxr-xr-x+ 1 otheruser otheruser    6 Jun 22 09:22 .


$ getfacl /tmp/badDir
getfacl: Removing leading '/' from absolute path names
# file: tmp/badDir
# owner: otheruser
# group: otheruser
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:me:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

$ getfacl /tmp/badDir/baz
getfacl: Removing leading '/' from absolute path names
# file: tmp/badDir/baz
# owner: otheruser
# group: otheruser
user::rw-
user:me:rwx     #effective:rw-
group::r-x          #effective:r--
mask::rw-
other::r--

Update 1

Just to confirm, I do have acls enabled:

$ sudo tune2fs -l /dev/disk/by-uuid/8d6bba7d-63c1-4406-855a-f56987dea98e | grep acl                                     
Default mount options:    user_xattr acl
4
  • 2
    But acl on a directory only affect itself, its children objects have their own acl, although you can set a default acl, the acl of a child may be changed in the future Jun 22, 2019 at 14:34
  • That's a good point, and it made me realize i should swap the ownership in my application, but I am not sure how the comment addresses the issue.
    – bbarker
    Jun 22, 2019 at 15:05
  • Try setting a default acl with: setfacl -dm "d:user:me:rwX" /tmp/badDir. Note the d: prefix
    – Stewart
    Jun 22, 2019 at 15:11
  • @Stewart I get $ sudo setfacl -dm "d:user:me:rwX" /tmp/badDir returning setfacl: Option -m: Invalid argument near character 1
    – bbarker
    Jun 22, 2019 at 15:48

1 Answer 1

0

A colleague pointed out to me that I need to set the permissions on the directory separately to the default permissions for files created in that directory. So you need both:

sudo setfacl -d -m "user:me:rwX" /tmp/badDir
sudo setfacl    -m "user:me:rwX" /tmp/badDir # Notice the missing -d

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.