Default mode parameters affecting ACL permissions

Question

I have just started working as sysadmin and encountered my first problem.

What I am trying to do is set permissions of a directory so that all the subdirectories and files in the directory AND newly created files can be used only by groups and users I let.

I have come this far:

setfacl -Rdm m::rwx mydir
setfacl -Rdm o::--- mydir
setfacl -Rdm g:everybody:rwx

I also set all those permissions without -d flag. In my understanding, the default mask determines the upper bound of permissions.

I expected that when a user belonging to group everybody creates new file:

touch mydir/newfile

that permissions on that file are rwx. However, they are rw-. I found out that if a default ACL exists (which it does), the permission bits assigned to the new object correspond to the overlapping portion of the permissions of the mode parameter and those that are defined in the default ACL.

I assume that mode parameters are interfering with my permissions, but I have not found a way to change that. I tried:

chmod a+rwx mydir

(and few modifications) and it didn't work.

So I guess the question is: how do I change default mode parameters so that they do not affect permissions set with ACL.

Answer 1

Your touch command does not set the executable bit. This means than whatever default ACL you assign to the directory, the touched file will not have the executable bit set.

This does not depend on ACLs: for example, think about the umask command, which operate on basic POSIX permissions. While you can set umask to not filter any permissions (and indeed root has all permissions enabled, by default), touch will not create an executable file.