setfacl access issues

Question

I have a list of users (user1,user2,user3,superuser). user1, user2 and user3 belong to a usergroup called normalusers . Now, I need to issue the access control list command for the user superuser to view the home pages of the users (user1, user2, user3). I have a setfacl command as below.

setfacl -m user:superuser:rx /home/user1

The above command works perfectly fine and the user superuser has access to user1 directory. Now, I need to issue the rights to the remaining users too. I wanted to apply the ACL rules to all the users inside the home directory. So, I issued the following command.

setfacl -m user:superuser:rx /home/

However, the above command did not allow me to view all the users. I was wondering if the setfacl command can be modified to access all the home directories belonging to a particular group.

Answer 1

You need the --recursive switch:

setfacl -R -m user:superuser:rx /home/

Otherwise the only thing that you are changing is the /home directory acl.

Answer 2

ACLs are applied to directories and files. You can't apply them to a group, at least not directly. You can apply them to all files/directories a group owns, by chaining with find:

find /home -group «some-group» -type d -exec setfacl -m u:superuser:rx '{}' '+'