CentOS Default ACLs on Existing File System Objects

Question

Is there a way to have existing file system objects inherit newly set default ACL settings of their parent directories?

The reason I need to do this is that I have an user who connect via SFTP to my server. They are able to change directories in their FTP client and see the root folder and the rest of the server. They don't have permissions to change or edit anything but their own user directory but I would like to prevent them from even view the contents of other directories.

Is there a better way to do this than ACLs? If ACLs are the way to go I'm assuming a default ACL on the root directory would be the best way to do restrict access. I could then selectively give the user permission to view certain directories. The problem is default ACLs are only inherited by new file system objects and not existing ones.

Answer 1

-d (or --default) is used to set the defaults on the directory so that things created in it inherit the perms.

e.g.

setfacl -d --set u::rwx,u:tippy:rwx,u:axel:rx,g::rx,g:lensmen:rx,o::- MYDIR

Here is a quick overview. http://www.vanemery.com/Linux/ACL/linux-acl.html#default

Answer 2

You'll have to manually set the ACLs on existing directories. Not hard to do:

find /path/to/ftp -type d -exec setfacl <acl spec> {} \;

As l1x mentioned, you'll need both an access ACL and a default ACL on your directories.

Answer 3

The current access permissions of file system objects called access ACL. A second type called default ACL is also defined. They define the permissions a file system object inherits from its parent directory at the time of its creation. Only directories can be associated with default ACLs. Default ACLs for non-directories would be of no use, because no other file system objects can be created inside non-directories. Default ACLs play no direct role in access checks.