0

I have to understand how POSIX ACL mask is recalculated. I read the man pages (https://man7.org/linux/man-pages/man1/setfacl.1.html) and there is the following explanation:

The default behavior of setfacl is to recalculate the ACL mask entry, unless a mask entry was 
explicitly given. The mask entry is set to the union of all permissions of the owning group, and
all named user and group entries.

Ok, it sounds clear, but in practice is not so easy as it seems. Let's suppose I have a group users and 2 users: student and jbond. The user student created a file test.txt with the following ACL list:

# file: test.txt
# owner: student
# group: users
user::rw-
user:jbond:rw-          #effective:r--
group::r--
mask::r--
other::r--

For now student can read and write and jbond can only read. Then I changed group permissions with chmod:

chmod g-r test.txt

And now the ACL list is:

# file: test.txt
# owner: student
# group: users
user::rw-
user:jbond:rw-          #effective:---
group::r--              #effective:---
mask::---
other::r--

And my question is how did it happen that the mask is ---? How was performed the union operation that is described in man pages. Is it the same as logical OR? If it is how to calculate it step by step? I really need to understand it.

System info: Open SUSE

Improve this question
1
  • A term called "POSIX ACL" does not exist. In 1993, there was a POSIX ACL proposal, but that was withdrawn before it has been standardized. The only existing ACL standard is the NFSv4 ACL standard. The problem with platforms that claim to implement the withdrawn POSIX draft is that there is no common behavior and that there is a separate command setfacl while modern UNIX systems tend to implement everything inside chmod.
    – schily
    Commented Jan 31, 2021 at 13:49

1 Answer 1

Reset to default
1

You didn't run setfacl, so it couldn't fix the mask for you. You ran chmod, which doesn't know about ACLs. If you now run setfacl -m user:jbond:rw test.txt, you should see it modify the mask too.

(Note that setfacl -m group::xyz is different from chmod g=xyz if there is an ACL mask, as the latter modifies the mask, while the former modifies the actual permissions for the owning group.)

Improve this answer
2
  • Thanks for the info on chmod g=xyz modifying the mask. I was trying to figure out why a particular directory in my container keeps having its ACL mask reset after restarts; it turns out one of the init scripts is running chmod on that directory on startup. Have you got a link to any official (or somewhat authoritative/trustworthy) source that documents this behaviour?
    – cyqsimon
    Commented Jul 1 at 7:23
  • 1
    @cyqsimon, it's in the acl(5) man page. I think I've written some longer post about this before, see e.g. unix.stackexchange.com/a/730254/170373 and the man page link there
    – ilkkachu
    Commented Jul 1 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .