adding stickybit without changing group owner permissions

Question

I have multiple files inside my dir with the following permissions :

 #ls -l /var/lib/dir/file1
-rw------- 1 root root 130 Jul  9 11:03 /var/lib/dir/file1

I want to allow a specific user to write and read all the users so I used facl :

setfacl -R -m u:myUser:rwX /var/lib/dir/

After doing so, all files in the dir got g+rw :

# ls -l /var/lib/dir/file1
-rw-rw----+ 1 root root 130 Jul  9 11:03 /var/lib/dir/file1

When I remove the g-rw I cant access the files with my specific user, I'm getting permission denied.

Any way to handle this ?

Answer 1

Changing the file ACL is tied with the file permissions bits settings.

The manpage for ACL reads as follows:

CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS

The permissions defined by ACLs are a superset of the permissions specified by the file permission bits.

There is a correspondence between the file owner, group, and other permissions and specific ACL entries: the owner permissions correspond to the permissions of the ACL_USER_OBJ entry. If the ACL has an ACL_MASK entry, the group permissions correspond to the permissions of the ACL_MASK entry. Otherwise, if the ACL has no ACL_MASK entry, the group permissions correspond to the permissions of the ACL_GROUP_OBJ entry. The other permissions correspond to the permissions of the ACL_OTHER_OBJ entry.

The file owner, group, and other permissions always match the permissions of the corresponding ACL entry. Modification of the file permission bits results in the modification of the associated ACL entries, and modification of these ACL entries results in the modification of the file permission bits.

When you view the ACL that you sent on file1, you can see the following output:

# owner: root 
# group: root 
user::rw-
user:myUser:rw- 
group::---
mask::rw- 
other::--- 

Note the mask settings. Mask settings will be reflected in the group setting. But when you change the file settings and remove group permissions, you also change the mask settings, thus effective permissions for user myUser are ---, because they are masked.

You can read further here and change the setup depending on what exactly you want to achieve. There is no way that you could change ACL without changing permissions bits.