On my RHEL 7.7 system, I am trying to allow user foo read and execute (no write) to everything under the /var/log/ directory, to include files, sub-directories, and files within those sub-directories. I have tried various setfacl commands but nothing seems to work recursively. It allows foo to access /var/log/ with rX permissions, but nothing in any sub-directory or file below that.

I tried the following variations with no success in foo accessing sub-directories below /var/log/

setfacl -Rm d:u:foo:rX,u:foo:rX /var/log
setfacl -Rm u:foo:rX,d:u:foo:rX /var/log
setfacl -R -m u:foo:rX /var/log
setfacl -m u:foo:rX /var/log

Pretty lost at this point and I'd rather use setfacl over chmod in order to ensure future folders and files (as well as existing) allow foo the right access.

UPDATE: The system has selinux in enforcing mode. I set to permissive, verified via getenforce, then ran my setfacl commands, tested with user foo and no success. Set the system back to enforcing mode.


This should be a comment, not an answer but I don't have enough points to comment. It could be due to SELinux. Check status, getenforce or sestatus. If the status is enforcing, you could try setenforce Permissive and then repeat the commands to see if it makes any difference. Yet I do not suggest disabling SELinux. If changing status makes a difference, you should then change /var/log SE labeling.

| improve this answer | |
  • It is in enforcing mode. Added an update to track the troubleshooting, but setting to permissive then re-running the setfacl commands didn't seem to make it work so I set it back to enforcing. The only thing that has worked thus far is to manually run my setfacl commands on all the directories I want user foo to access (recursive not working as expected through directories). setfacl... /var/log | setfacl... /var/log/folder1 | setfacl.../var/log/folder2 – user2661503 Apr 17 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.