0

Note: to clarify the question, I am assuming an empty directory to start; I realize if it was non-empty I could use the -R option to setfacl.

Here's what I tried (wanting to give access of /tmp/badDir to user me, when it was created and owned by otheruser):

$ sudo -u otheruser mkdir /tmp/badDir
$ sudo setfacl -dm "user:me:rwX" /tmp/badDir
$ sudo -u otheruser touch /tmp/badDir/baz
$ touch /tmp/badDir/baz

So at first glance this looks good.

But then if I try certain other operations that I need, it isn't what I expect:

$ touch /tmp/badDir
touch: setting times of '/tmp/badDir': Permission denied
$ touch /tmp/badDir/foo
touch: cannot touch '/tmp/badDir/foo': Permission denied

So it looks like I can't modify the directory metadata or create files within the directory, though I can modify files within the directory created by the user otheruser.

Output of ls and getfacl is:

$ ls -last /tmp/badDir
total 0
0 drwxrwxrwt  1 root     root     1794 Jun 22 09:22 ..
0 -rw-rw-r--+ 1 otheruser otheruser    0 Jun 22 09:22 baz
0 drwxr-xr-x+ 1 otheruser otheruser    6 Jun 22 09:22 .


$ getfacl /tmp/badDir
getfacl: Removing leading '/' from absolute path names
# file: tmp/badDir
# owner: otheruser
# group: otheruser
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:me:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

$ getfacl /tmp/badDir/baz
getfacl: Removing leading '/' from absolute path names
# file: tmp/badDir/baz
# owner: otheruser
# group: otheruser
user::rw-
user:me:rwx     #effective:rw-
group::r-x          #effective:r--
mask::rw-
other::r--

Update 1

Just to confirm, I do have acls enabled:

$ sudo tune2fs -l /dev/disk/by-uuid/8d6bba7d-63c1-4406-855a-f56987dea98e | grep acl                                     
Default mount options:    user_xattr acl
4
  • 2
    But acl on a directory only affect itself, its children objects have their own acl, although you can set a default acl, the acl of a child may be changed in the future Jun 22, 2019 at 14:34
  • That's a good point, and it made me realize i should swap the ownership in my application, but I am not sure how the comment addresses the issue.
    – bbarker
    Jun 22, 2019 at 15:05
  • Try setting a default acl with: setfacl -dm "d:user:me:rwX" /tmp/badDir. Note the d: prefix
    – Stewart
    Jun 22, 2019 at 15:11
  • @Stewart I get $ sudo setfacl -dm "d:user:me:rwX" /tmp/badDir returning setfacl: Option -m: Invalid argument near character 1
    – bbarker
    Jun 22, 2019 at 15:48

1 Answer 1

0

A colleague pointed out to me that I need to set the permissions on the directory separately to the default permissions for files created in that directory. So you need both:

sudo setfacl -d -m "user:me:rwX" /tmp/badDir
sudo setfacl    -m "user:me:rwX" /tmp/badDir # Notice the missing -d

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .