cp overrides my default permissions settings, when copying files with: cp -r --no-preserve=all

Question

My default umask is 077. When I create a directory, it has permissions 700:

mkdir AA
$ stat -c'%A %n' AA/               
drwx------ AA/

now I want to set default permissions recursively to 750:

setfacl -R --default --modify g::rx,o::--- AA

and confirm it works as expected:

$ touch AA/zz
$ stat -c'%A %n' AA/zz
-rw-r----- AA/zz

Now I want to copy another existing directory ZZ inside my new AA:

$ stat -c'%A %n' ZZ ZZ/zz 
drwx------ ZZ
-rw------- ZZ/zz

that existing directory has permissions 700 and file inside has 600.

$ cp -r --no-preserve=all ZZ/ AA/

$ stat -c'%A %n' AA/ZZ AA/ZZ/zz 
drwx------ AA/ZZ
-rw------- AA/ZZ/zz

but my umask is not honored, even though I have used --no-preserve=all to specifically not transfer existing permissions from the existing ZZ.

How can I make cp act the same as if when I use touch to create new files? Regardless what the original permissions are, I want to copy over an existing directory structure, while honoring my default umask/setfacl settings.

Answer 1

Solution: Using Debian 11.5 / cp (GNU coreutils) 8.32

1) This will use your user umask:

$ cp -r --no-preserve=all ZZ/ AA/

2) This will use effective umask from destination directory:

$ cp -r ZZ/ AA/

3) This will not use any umask:

$ cp -r --preserve=all ZZ/ AA/

You as (user that can create file in AA directory) have no restriction to overwrite default mode of file you create. That include when using utility as cp. Acl is not restricting you from creating any file permissions as long as you have write permission.

Conclusion: All works as expected. The utility cp need one more options that will use user umask and acl if exist.

#=========================================================

This is part of manual for "acl":

CHANGES TO THE FILE UTILITIES

On a system that supports ACLs, the file utilities ls(1), cp(1), and mv(1) change their behavior in the following way:

• For files that have a default ACL or an access ACL that contains more than the three required ACL entries, the ls(1) utility in the long form produced by ls -l displays a plus sign (+) after the permission string.

• If the -p flag is specified, the cp(1) utility also preserves ACLs. If this is not possible, a warning is produced. ......

#----------------------------------------------------------------

STANDARDS

The IEEE 1003.1e draft 17 (“POSIX.1e”) document describes several security extensions to the IEEE 1003.1 standard. While the work on 1003.1e has been abandoned, many UNIX style systems implement parts of POSIX.1e draft 17, or of earlier drafts.

Linux Access Control Lists implement the full set of functions and utilities defined for Access Control Lists in POSIX.1e, and several extensions. The implementation is fully compliant with POSIX.1e draft 17; extensions are marked as such. The Access Control List manipulation functions are defined in the ACL library (libacl, -lacl). The POSIX compliant interfaces are declared in the <sys/acl.h> header. Linux-specific extensions to these functions are declared in the <acl/libacl.h> header.