Is there a way to disable all write access for a specific user in a directory?

Question

I recently learned about ACL and setfacl for setting per-user access rights. But there is one thing that I cannot figure out how to pull off, and that is restricting all write(*) access for a specific user in a specific directory and everything inside it.

To put it another way, consider a user some_user and a directory some_dir (suppose chmod 777 some_dir has been used). Is there a way to restrict some_user's write access - without altering any other access right - in some_dir and all of its content?

What I have tried/thought of:

• setfacl -R -m u:some_user:rx some_dir/ won't do the trick as it would give some_user read access to files that the user might have not been able to read before, as well as execute access to files the user might have not been able to execute before.
• Setting a r-x mask to some_dir recursively (again with setfacl) also won't do it, as there is no way to make a mask specific to one user (as far as I know)

Having skimmed through ACL documentation, I haven't come across anything that points to this direction, so just to be clear, I am not necessarily looking for a way to do this with ACL.

(*) or read, or execute access - I guess it shouldn't matter which one it is, but I will stick with write access to keep it simple

Answer 1

Before applying acl for user p3 Now every have full access on directory k2

 mkdir k2

 chmod 777 k2
getfacl k2
# file: k2
# owner: praveen
# group: praveen
user::rwx
group::rwx
other::rwx

Now lets restrict user p3 write acess on the directory k2

 setfacl -m u:p3:rx k2
$ getfacl k2
# file: k2
# owner: praveen
# group: praveen
user::rwx
user:p3:r-x    =====> user p3  have only read and execute acess not write
group::rwx
mask::rwx
other::rwx