0

I have user bala-sftp. Evertime the user writes a file to folder /balab/settlement/report currently it is

-rw-rw-r-- 1 bala-sftp        sftponly  5295 Oct 18 19:00 settlementreport_switch_20201018.csv

but permission should be

-rw-r----- 1 bala-sftp        sftponly  5295 Oct 18 19:00 settlementreport_switch_20201018.csv

How can I acheive this via setfacl ?

1 Answer 1

0

This will ensure new files created in /balab/settlement/report are group readable, but not group writable.

setfacl -m -d g::r /balb/settlement/report

Here is an example if it in action:

stew ~$ umask 0002                               # New files will be -rw-rw-r-- like yours
stew ~$ cd $(mktemp -d)                          # Going to a new directory
stew /tmp/tmp.JgZyxzKcf8 $ getfacl .             # It has no ACL rules yet
# file: .
# owner: stew
# group: stew
user::rwx
group::---
other::---

stew /tmp/tmp.JgZyxzKcf8 $ touch before          # File to demonstrate pre-ACL rule
stew /tmp/tmp.JgZyxzKcf8 $ setfacl -d -m g::r .  # Set the default acls to group-read-only
stew /tmp/tmp.JgZyxzKcf8 $ touch after           # File to demonstrate post-ACL rule
stew /tmp/tmp.JgZyxzKcf8 $ ls -lr
total 0
-rw-rw-r-- 1 stew stew 0 Nov  2 12:39 before     # Pre-ACL is world readable 
-rw-r----- 1 stew stew 0 Nov  2 12:39 after      # Post-ACL is group readable only

New files that are group-writable is a little weird. If bala-sftp's umask outputs 0022 (linux default), then you may need to delete existing ACLs. Do that with setfacl -b /balb/settlement/report. I suspect bala-sftp's umask is 0002 which is why I set my own umask like that during my test.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.