I'd like to use setfacl so that anyone in group 'app' can edit any file contained within /usr/local/users/app regardless of what the traditional UNIX permissions say. I have two users john and ben. I tried to follow the instruction from another question, but john is not able to write to some files. It looks like this is because of the acl mask. However, I've set default mask on the directory of rwx, so shouldn't the files within it inherit that when created?

E.g. john cannot write to the file below, but he is a member of group 'app' which has write acls on the file so I'm surprised he can't edit the file.

ben@app1:/usr/local/users$ ls -la app/app-1.0-SNAPSHOT/lib/play.templates_2.10-2.1.1.jar 
-rw-r--r--+ 1 ben users 38326 Apr  2 10:21 app/app-1.0-SNAPSHOT/lib/play.templates_2.10-2.1.1.jar

ben@app1:/usr/local/users/app$ getfacl app-1.0-SNAPSHOT/lib/
# file: app-1.0-SNAPSHOT/lib/
# owner: ben
# group: users
group::rwx          #effective:r-x
group:app:rwx       #effective:r-x

ben@app1:/usr/local/users$ getfacl app/app-1.0-SNAPSHOT/lib/play.templates_2.10-2.1.1.jar 
# file: app/app-1.0-SNAPSHOT/lib/play.templates_2.10-2.1.1.jar
# owner: ben
# group: users
group::rwx          #effective:r--
group:app:rwx       #effective:r--

2 Answers 2


You'll notice the "effective" comment that getfacl is throwing out at you. The issue is that permissions are calculating so that "app" isn't getting the write bit set. That's happening because the mask on the file is set to read-only. The mask is used to limit the amount of permissions that could possibly be given out on a particular file or directory.

An example of why you would want this behavior would be like if you knew the file could legitimately need different users/groups to have access to it but for some reason things were getting complicated with permissions and you wanted a way to say "Whatever the other default permissions are set to, whatever their group memberships are, or whatever recursive setfacl gets executed later on, DEFINITELY DON'T GIVE THIS OUT!" The owning user has a special status in the POSIX world, it has rights other users don't have, like the ability to be non-root and change permissions on a file and have its rights not be limited by the mask (which would be pointless anyways because of the first privilege the system gives them). This is why they still get rwx even though the mask is restricted.

To answer your specific question though: add the write bit to the mask on the file and try again as the john user.

here is a command line version of the above explanation, take note of how the "effective" rights change when all I modify is the mask.

  • Thank you. I really appreciate the response. Is it possible for new files to be created with a default mask of rwx? I've edited my question with a few more details.
    – Ben McCann
    Apr 8, 2013 at 21:28
  • Yeah the mask is one of the categories (like users and groups) that you can set a default ACL on. The default mask should inherit to subdirectories and apply to files. EXAMPLE: setfacl -m d:m::rwx /path/to/Dir
    – Bratchley
    Apr 8, 2013 at 22:36
  • The default ACL is inheriting to subdirectories, but not to files, making the ACLs completely useless :-(
    – Ben McCann
    Apr 8, 2013 at 22:48
  • Just to make sure we're talking about the same thing, you're talking about the default acl for the mask entry? This is what I get in tests.
    – Bratchley
    Apr 9, 2013 at 12:11
  • I've also repeated the above test for new files in /testBed after changing the effective mask on the parent directory and gotten the same result (default mask entry gets applied to the file and not the parent's effective mask).
    – Bratchley
    Apr 9, 2013 at 12:14

It is impossible. cp, rsync, etc. create files ignoring default ACLs

Why does cp not respect ACLs?

  • incorrect The user was running into the same mask thing you were running into earlier and got an incorrect response from someone else. It's not up to "cp" or any other utility to ignore the default ACL entries, that happens at the filesystem level when cp goes to create the file. The tool has the option to issue the system calls to stripe/add the necessary ACL's but would have to make an effort to do so.
    – Bratchley
    Apr 9, 2013 at 12:43
  • The hell of that is that you can see the ACL entry their talking about it's just the effective permissions they're expecting to see aren't there. That was a perfect opportunity to say "hey dude, check your mask."
    – Bratchley
    Apr 9, 2013 at 12:46
  • 1
    Actually, I take that back it looks like EvilRyry posted about the mask and the OP just responded back with "it didn't work" then posted getfacl output that seems to show that "felles" did get rwx on the file. At this rate, the highest voted answer doesn't match up with my personal experience and what I've illustrated here with command examples.
    – Bratchley
    Apr 9, 2013 at 19:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .