Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got some legacy code which checks that some file is read-only and readable only by it's owner, i.e. permissions set to 0400. I also need to give read-only access to this file to some other user on the system. I'm trying to set extended ACLs, but this changes 'regular' permission bits in a strange way also:

$ ls -l hostkey.pem 
-r-------- 1 root root 0 Jun  7 23:34 hostkey.pem
$ setfacl -m user:apache:r hostkey.pem 
$ getfacl hostkey.pem 
# file: hostkey.pem
# owner: root
# group: root
user::r--
user:apache:r--
group::---
mask::r--
other::---

$ ls -l hostkey.pem 
-r--r-----+ 1 root root 0 Jun  7 23:34 hostkey.pem

And after this the legacy code starts complaining that the file is group-readable (while it is actually not!)

Is it possible to set the extended ACLs in such a way that some other user will also have read-only access, while the file will appear to have only 0400 'regular' permissions?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

We've seen something like this in our experiments with Linux ACLs, especially via Samba. But in most cases, even though the regular permission/file mode bits are changed in strange ways, the system still performs overall as intended.

I remember reading somewhere (can't remember where, sorry) that when creating files (possibly via Samba) that the ACL permissions weren't properly reflected in the mode bits until data was written to the file. This would affect files created using, e.g., touch.

Something else to consider is whether you might want to set default ACLs.

We use something like this when creating new directory with ACL-protected files; the last command, with getfacl piped into setfacl, copies the currently-set ACLs to be used as default ACLs for new files created in this directory:

chown --recursive $username:$userrole /home/data/private/$datadir
chmod --recursive u=rwx,g=,o= /home/data/private/$datadir

# remove previous ACLs
setfacl --recursive --remove-all /home/data/private/$datadir

# User/group access for owner, group leader and web server
setfacl --recursive -m u:$username:rwx /home/data/private/$datadir
setfacl --recursive -m g:RGLeader:rx /home/data/private/$datadir
setfacl --recursive -m u:www-data:rwx /home/data/private/$datadir

# Copy access modes to default access modes
getfacl --access /home/data/private/$datadir | setfacl --recursive -d -M- /home/data/private/$datadir
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.