I've created the following ACLs for a directory:
# file: .
# owner: www-data
# group: root
user::rwx
user:www-data:rwx
user:deploy:rwx
group::---
mask::rwx
other::---
default:user::rwx
default:user:www-data:rwx
default:user:deploy:rwx
default:group::---
default:mask::rwx
default:other::---
However, if a script creates a new directory and specifies a bitmask, the default mask isn't applied.
How can I force this ACL to take effect regardless of the bitmask that's supplied to mkdir()?