4

Question similar to Why does cp not respect ACLs? on ServerFault but different in one thing: I have set the default permissions of the new files created in the folder /home/myuser and subfolders:

setfacl -dR -m u::rwx,g::rx,o::rx ~ 2> /dev/null

The getfacl ~ command gives me the following output:

getfacl: Removing leading '/' from absolute path names
# file: home/lohacker
# owner: lohacker
# group: lohacker
user::rwx
group::r-x
other::---
default:user::rwx
default:group::r-x
default:other::r-x

Folder ACL permissions take effect when creating a new file but not copying a new file using the cp command, even though I don't preserve the permissions of the source file.
For example, having this function:

cp () {
    command cp -a --no-preserve=mode,ownership --remove-destination "$@"
    return $?
}

and assuming I am in ~:

> file.txt
cp file.txt file2.txt
ls -l file.txt file2.txt
getfacl file.txt file2.txt

gives me the output:

-rw-rw-r-- 1 lohacker lohacker 0 Jul 26 13:05 file2.txt
-rw-r--r-- 1 lohacker lohacker 0 Jul 26 13:05 file.txt

# file: file.txt
# owner: lohacker
# group: lohacker
user::rw-
group::r--
other::r--

# file: file2.txt
# owner: lohacker
# group: lohacker
user::rw-
group::rw-
other::r--

I would have expected -rw-r--r-- to both files, but unfortunately it isn't.
Is there a way to solve the problem using the cp command anyway but without having to preserve the permissions of the source file?

3
  • In this particular case, you'd get the desired permissions for file2.txt with a plain cp or with cp --preserve=mode. I don't know what GNU cp is doing with --no-preserve=mode here. Jul 26, 2022 at 17:52
  • I'm voting to close this question because it doesn't have a clear objective. In the one specific case you describe, plain cp would give the desired result. But apparently that's not what you're looking for, so what do you want? You need to describe the whole logic, not just one specific case. Jul 26, 2022 at 17:53
  • 1
    @Gilles'SO-stopbeingevil', since the default is --preserve=mode,ownership,timestamps (that's what the doc says), would have expected --no-preserve=mode to do the same as plain cp. But it doesn't. With that option, it explicitly sets the ACL. The same happens without ACLs too, if the destination file exists, --preserve=mode copies the original file's mode, but --no-preserve=mode overrides using the current umask, while the default just lets the existing file mode be.
    – ilkkachu
    Jul 28, 2022 at 16:09

1 Answer 1

0

I can change the default permissions without using ACL setfacl -bR ~ 2> /dev/null but using the umask command, so the solution is to comment out a line in the /etc/login.defs file. This:

UMASK       022

becomes:

#UMASK      022

By unsetting UMASK in /etc/login.defs, this value stops being affected by the value of USERGROUPS_ENAB variable, which is set to yes and is convenient because thanks to it, when executing the deluser command, the group with the same gid as the user uid and the same name as the user is also deleted (if the group has no other members), without having to do it later.

# If USERGROUPS_ENAB is set to "yes", that will modify this UMASK default value
# for private user groups, i. e. the uid is the same as gid, and username is
# the same as the primary group name: for these, the user permissions will be
# used as group permissions, e. g. 022 will become 002.

In this way, the cp command will give -rw-r--r-- to the copied file, even without preserving permissions.

Here is the general formula:

perl -pi -e 's/^\h*(UMASK\h+.*[^\h])\h*$/#\1/i' /etc/login.defs

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .