I'm attempting to execute the ls
command on a directory which has acl permissions for the owner and group of the directory (with no standard posix permissions set). This results in a Permission Denied even though getfacl
says the user should be able to do so.
Here's what I'm doing:
- Create a directory and a file inside it.
mkdir /tmp/mydir && touch /tmp/mydir/myfile
- Check if I can execute
ls
on this directory.
jgazula@gazula:/tmp$ ls -al /tmp/mydir/
total 896
drwxrwxr-x 2 jgazula jgazula 4096 Nov 1 11:57 .
drwxrwxrwt 25 root root 909312 Nov 1 11:57 ..
-rw-rw-r-- 1 jgazula jgazula 0 Nov 1 11:57 myfile
- Now, let's remove all the standard posix permissions on this directory.
chmod 000 /tmp/mydir
- Verify the permissions.
jgazula@gazula:/tmp$ ls -al /tmp | grep mydir
d--------- 2 jgazula jgazula 4096 Nov 1 11:57 mydir
- We shouldn't be able to
ls
now.
jgazula@gazula:/tmp$ ls -al /tmp/mydir/
ls: cannot open directory '/tmp/mydir/': Permission denied
- Set the acl permissions for the
jgazula
user and group.
sudo setfacl --mask -Rm u:jgazula:rwx,g:jgazula:rwx /tmp/mydir/
- Verify the acl permissions.
jgazula@gazula:/tmp$ getfacl -ep /tmp/mydir/
# file: /tmp/mydir/
# owner: jgazula
# group: jgazula
user::---
user:jgazula:rwx #effective:rwx
group::--- #effective:---
group:jgazula:rwx #effective:rwx
mask::rwx
other::---
- Since the acl permissions (including the effective permissions) look good, I should be able to execute
ls
on the directory?
jgazula@gazula:/tmp$ ls -al /tmp/mydir/
ls: cannot open directory '/tmp/mydir/': Permission denied
But I can't and I don't understand why.
- Interestingly enough, when I check the standard posix permissions, the group permission bits have been set? Not sure I understand why only group permissions have been updated.
jgazula@gazula:/tmp$ ls -al /tmp | grep mydir
d---rwx---+ 2 jgazula jgazula 4096 Nov 1 12:13 mydir
- Let's set the acl permissions for the owner and group (i.e, omit the owner/group from the command).
sudo setfacl --mask -Rm u::rwx,g::rwx /tmp/mydir/
- Verify the acl permissions again.
jgazula@gazula:/tmp$ getfacl -ep /tmp/mydir/
# file: /tmp/mydir/
# owner: jgazula
# group: jgazula
user::rwx
user:jgazula:rwx #effective:rwx
group::rwx #effective:rwx
group:jgazula:rwx #effective:rwx
mask::rwx
other::---
- Check if I can execute
ls
now.
jgazula@gazula:/tmp$ ls -al /tmp/mydir/
total 896
drwxrwx---+ 2 jgazula jgazula 4096 Nov 1 11:57 .
drwxrwxrwt 25 root root 909312 Nov 1 11:57 ..
-rwxrwxr--+ 1 jgazula jgazula 0 Nov 1 11:57 myfile
Why does step #6 not work by itself? I'm setting the acl permissions explicitly for a user and group. Why do I need to execute step #11?