1

I have this weird issue, I'm trying to wrap my mind around acl to give some developers write access to a few files in a folder

This is an example folder structure, I have a settings.local.php file there, and I'm giving it 000 permissions with chmod, then I'm giving it rwX permissions with setfacl, it's succesful, as in getfacl does give me the correct permissions, but owner permissions are not affected, and the user can't actually save the file, actually on this example, the user can't even read the file...

hostname:/srv/clientname/sites/local# chmod 000 *

hostname:/srv/clientname/sites/local# ls -la
total 64
dr-xrwxrwx+  3 clientname www-data  4096 Jun 19 16:50 .
drwxrwxrwx+  5 clientname www-data  4096 Jun 19 16:51 ..
----------+  1 clientname www-data   775 Jun 19 16:50 settings.local.php

hostname:/srv/clientname/sites/local# groups clientname
clientname : www-data sftp ftp

hostname:/srv/clientname/sites/local# setfacl -m u:clientname:rwX *

hostname:/srv/clientname/sites/local# ls -la
dr-xrwxrwx+  3 clientname www-data  4096 Jun 19 16:50 .
drwxrwxrwx+  5 clientname www-data  4096 Jun 19 16:51 ..
----rw----+  1 clientname www-data   775 Jun 19 16:50 settings.local.php

hostname:/srv/clientname/sites/local# getfacl settings.local.php
# file: settings.local.php
# owner: clientname
# group: www-data
user::---
user:www-data:rw-
user:clientname:rw-
group::r--
group:www-data:rw-
mask::rw-
other::---

what am I doing wrong

1 Answer 1

1

ACLs supplement regular permissions, they don’t replace them. Since clientname is the owner of the file, the owner ACL is applied first. That’s

user::---

(which matches the owner permissions), and access is denied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.