setfacl doesn't apply permissions recursively

Question

On my RHEL 7.7 system, I am trying to allow user foo read and execute (no write) to everything under the /var/log/ directory, to include files, sub-directories, and files within those sub-directories. I have tried various setfacl commands but nothing seems to work recursively. It allows foo to access /var/log/ with rX permissions, but nothing in any sub-directory or file below that.

I tried the following variations with no success in foo accessing sub-directories below /var/log/

setfacl -Rm d:u:foo:rX,u:foo:rX /var/log
setfacl -Rm u:foo:rX,d:u:foo:rX /var/log
setfacl -R -m u:foo:rX /var/log
setfacl -m u:foo:rX /var/log

Pretty lost at this point and I'd rather use setfacl over chmod in order to ensure future folders and files (as well as existing) allow foo the right access.

UPDATE: The system has selinux in enforcing mode. I set to permissive, verified via getenforce, then ran my setfacl commands, tested with user foo and no success. Set the system back to enforcing mode.

Answer 1

This should be a comment, not an answer but I don't have enough points to comment. It could be due to SELinux. Check status, getenforce or sestatus. If the status is enforcing, you could try setenforce Permissive and then repeat the commands to see if it makes any difference. Yet I do not suggest disabling SELinux. If changing status makes a difference, you should then change /var/log SE labeling.