5

My default umask is 077. When I create a directory, it has permissions 700:

mkdir AA
$ stat -c'%A %n' AA/               
drwx------ AA/

now I want to set default permissions recursively to 750:

setfacl -R --default --modify g::rx,o::--- AA

and confirm it works as expected:

$ touch AA/zz
$ stat -c'%A %n' AA/zz
-rw-r----- AA/zz

Now I want to copy another existing directory ZZ inside my new AA:

$ stat -c'%A %n' ZZ ZZ/zz 
drwx------ ZZ
-rw------- ZZ/zz

that existing directory has permissions 700 and file inside has 600.

$ cp -r --no-preserve=all ZZ/ AA/

$ stat -c'%A %n' AA/ZZ AA/ZZ/zz 
drwx------ AA/ZZ
-rw------- AA/ZZ/zz

but my umask is not honored, even though I have used --no-preserve=all to specifically not transfer existing permissions from the existing ZZ.

How can I make cp act the same as if when I use touch to create new files? Regardless what the original permissions are, I want to copy over an existing directory structure, while honoring my default umask/setfacl settings.

9

1 Answer 1

0

Solution: Using Debian 11.5 / cp (GNU coreutils) 8.32

1) This will use your user umask:

$ cp -r --no-preserve=all ZZ/ AA/

2) This will use effective umask from destination directory:

$ cp -r ZZ/ AA/

3) This will not use any umask:

$ cp -r --preserve=all ZZ/ AA/

You as (user that can create file in AA directory) have no restriction to overwrite default mode of file you create. That include when using utility as cp. Acl is not restricting you from creating any file permissions as long as you have write permission.

Conclusion: All works as expected. The utility cp need one more options that will use user umask and acl if exist.

#=========================================================

This is part of manual for "acl":

CHANGES TO THE FILE UTILITIES

On a system that supports ACLs, the file utilities ls(1), cp(1), and mv(1) change their behavior in the following way:

• For files that have a default ACL or an access ACL that contains more than the three required ACL entries, the ls(1) utility in the long form produced by ls -l displays a plus sign (+) after the permission string.

If the -p flag is specified, the cp(1) utility also preserves ACLs. If this is not possible, a warning is produced. ......

#----------------------------------------------------------------

STANDARDS

The IEEE 1003.1e draft 17 (“POSIX.1e”) document describes several security extensions to the IEEE 1003.1 standard. While the work on 1003.1e has been abandoned, many UNIX style systems implement parts of POSIX.1e draft 17, or of earlier drafts.

Linux Access Control Lists implement the full set of functions and utilities defined for Access Control Lists in POSIX.1e, and several extensions. The implementation is fully compliant with POSIX.1e draft 17; extensions are marked as such. The Access Control List manipulation functions are defined in the ACL library (libacl, -lacl). The POSIX compliant interfaces are declared in the <sys/acl.h> header. Linux-specific extensions to these functions are declared in the <acl/libacl.h> header.

1
  • To explain Answer to question: "How can I make cp act the same as if when I use touch to create new files? " You can not with just cp. You can using chmod to 777 and then use cp as in example 2 of my answer. ACL is not adding permissions, it restricting them when using plain "cp" command. ACL will not add permissions if file you copy do not have them to begin with. In short ACL act as filter removing permissions (as expected). Use two commands: chmod 777 ZZ ZZ/zz; cp -r ZZ AA; (This is for explanation only, changing permission to 777 is not safe).
    – Bogdan_G
    Commented Sep 21, 2022 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .