setfacl undoes itself

senseproof · 05-05-2009, 04:17 PM

I am trying to give a user access to read roots mail with the setfacl. So I do:

Code:

setfacl -m u:ben:rw /var/spool/mail/root

It works for a while, then suddenly ben cannot read the file anymore.

Code:

getfacl /var/spool/mail/root

displays this while it works:

Code:

user:ben:rw-

And this when it doesn't:

Code:

user:ben:rw-                   #effective:---

What is this #effective and why does it keep happening after a short time. My filesystem is mounted with the acl option.

chrism01 · 05-05-2009, 07:58 PM

Once you've read all the emails in the file, they get moved to 'mbox' and the orig mail file is deleted (along with the acl).
What you need is a default acl, which is set on the dir eg

Code:

 Automatic ACL setting
 • New files inherit default ACL (if set) from directory
 • setfacl -m d:u:ben:rw directory

senseproof · 05-05-2009, 10:52 PM

Thanks for that, you are right that is the problem.

Code:

# ls -lc root
-rw-------+ 1 root root 1397 2009-05-06 04:01 root

It's a new file just like you say. So how come the old ACL shows up at all? That is confusing!

senseproof · 05-11-2009, 09:39 PM

Few days on, I applied your directory settings (suprisingly they were set rw for all users anyway according to getfacl).

Anyhow, my root mail file still keeps un-doing itself. I'm open to putting a one minute crontab on there to change the permissions back to what I want them to be but it would be nice to learn something about how to make the ACL do it itself...