setfacl changes group permissions; giving another user rw permissions

secretlydead · 09-21-2012, 05:47 PM

i have a file:

Code:

ls -l ./file.php
-rw-r-----+ 1 me me 53762  ./file.php

i need to keep this file with permissions 640 for the sake of the web server.

but i also need to give rw (6) permissions to another user on the system.

so i tried this:

Code:

setfacl -n -m u:me2:rw ./file.php

so far so good. 640 permissions retained:

Code:

ls -l ./file.php
-rw-r-----+ 1 me me 53762 ./file.php

but:

Code:

getfacl ./file.php
# file: file.php
# owner: me
# group: me
user::rw-
user:me2:rw-			#effective:r--
group::r--
mask::r--
other::---

crap. ok, well, we'll try without the -n tag:

Code:

setfacl -m u:me2:rw ./file.php

OK, looking ok with the user permissions:

Code:

getfacl ./file.php
# file: file.php
# owner: me
# group: me
user::rw-
user:me2:rw-
group::r--
mask::rw-
other::---

D'oh! permissions have been changed:

Code:

ls -l ./file.php
-rw-rw----+ 1 me me 53762 ./file.php

so, my question is, how do i give this user read-write access to this file without changing the base permissions (640)?

Reuti · 09-22-2012, 03:13 PM

The output is misleading. If the an ACL mask is present, it will no longer show the rights of the group, but the ACL mask entry. Hence it will give a hint, what maximum permission is granted to someone else besides the owner.

It’s outlined in man ACL paragraph CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS.

secretlydead · 09-22-2012, 04:43 PM

the manual states:

If the ACL has an ACL_MASK
entry, the group permissions correspond to the permissions of the
ACL_MASK entry.

and:

ACL_MASK The ACL_MASK entry denotes the maximum access
rights that can be granted by entries of type
ACL_USER, ACL_GROUP_OBJ, or ACL_GROUP.

So, in other words, it seems impossible to keep 640 rights on a file and also add a user with setfacl with rw permissions.

Is there another way to do this? (Keep permissions at 640 and grant rw access to another user?)

Reuti · 09-22-2012, 05:11 PM

The output changed. Did you try to have a user with “user”/“group” being “foobar”/“me” and write to the file?

secretlydead · 09-22-2012, 11:12 PM

The "user/group" that was executing all the setfacl commands was "me/me".