This will ensure new files created in
/balab/settlement/report are group readable, but not group writable.
setfacl -m -d g::r /balb/settlement/report
Here is an example if it in action:
stew ~$ umask 0002 # New files will be -rw-rw-r-- like yours
stew ~$ cd $(mktemp -d) # Going to a new directory
stew /tmp/tmp.JgZyxzKcf8 $ getfacl . # It has no ACL rules yet
# file: .
# owner: stew
# group: stew
stew /tmp/tmp.JgZyxzKcf8 $ touch before # File to demonstrate pre-ACL rule
stew /tmp/tmp.JgZyxzKcf8 $ setfacl -d -m g::r . # Set the default acls to group-read-only
stew /tmp/tmp.JgZyxzKcf8 $ touch after # File to demonstrate post-ACL rule
stew /tmp/tmp.JgZyxzKcf8 $ ls -lr
-rw-rw-r-- 1 stew stew 0 Nov 2 12:39 before # Pre-ACL is world readable
-rw-r----- 1 stew stew 0 Nov 2 12:39 after # Post-ACL is group readable only
New files that are group-writable is a little weird. If
0022 (linux default), then you may need to delete existing ACLs. Do that with
setfacl -b /balb/settlement/report. I suspect
0002 which is why I set my own
umask like that during my test.