I am trying to understand this Unix behavior (which I happen to be testing on Ubuntu 11.10):
$ touch foo
$ setfacl -m u:nobody:rwx foo
$ getfacl foo
# file: foo
# owner: michael
# group: michael
user::rw-
user:nobody:rwx
group::rw-
mask::rwx
other::r--
$ chmod g-rw foo
$ getfacl foo
# file: foo
# owner: michael
# group: michael
user::rw-
user:nobody:rwx #effective:--x
group::rw- #effective:---
mask::--x
other::r--
Notice that the chmod(1) command has updated the ACL mask. Why does this happen?
The SunOS manpage has the following to say:
If you use the chmod(1) command to change the file group owner permissions on a file with ACL entries, both the file group owner permissions and the ACL mask are changed to the new permissions. Be aware that the new ACL mask permissions may change the effective permissions for additional users and groups who have ACL entries on the file.
I ask because it would be convenient for me if chmod(1) did not have this behavior. I hope that by understanding why it does what it does, I can better design how I set up filesystem permissions.