unix/setfacl: set directory default acl for correct permission inheritance

Question

I have several svn repositories in /projects/svn which should be writeable by 2 users, mine (unix), and wwwrun (apache, for svn over http)

newly created folders and file should be read/writeable by both users

i played around with setfacl but couldn't get it working the way i need it

my attempt was as follows:

unknown:/projects/svn # setfacl -b .
unknown:/projects/svn # setfacl -m u:unix:rwx,u:wwwrun:rwx,m:rwx .
unknown:/projects/svn # setfacl -dm u:unix:rwx,u:wwwrun:rwx,m:rwx .
unknown:/projects/svn # getfacl .
# file: .
# owner: unix
# group: users
user::rwx
user:wwwrun:rwx
user:unix:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:wwwrun:rwx
default:user:unix:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

unknown:/projects/svn # su -s /bin/bash wwwrun
wwwrun@unknown:/projects/svn> md test
wwwrun@unknown:/projects/svn> getfacl test
# file: test
# owner: wwwrun
# group: www
user::rwx
user:wwwrun:rwx                 #effective:r-x
user:unix:rwx                   #effective:r-x
group::r-x
mask::r-x
other::r-x
default:user::rwx
default:user:wwwrun:rwx
default:user:unix:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

wwwrun@unknown:/projects/svn>

as you can see, my user (unix) has only r-x (as effective) permissions

Answer 1

well, i should've just read the manual...

http://www.suse.de/~agruen/acl/linux-acls/online/#SECTION00040000000000000000
Section 'How ACLs Work'

my group bit was to restrictive (r-w), which restricted the mask to r-x, and subsequently the named users in my ACL could not write

actually, it's rather simple :)

Answer 2

I cannot reproduce what you get; I get the expected behaviour whether I include the m:rwx or not. This is on a Linux Ubuntu 10.04 LTS (Lucid Lynx) with kernel 2.6.32-24-generic, the ext4 filesystem and setfacl v. 2.2.49: (Users 'bhm' and 'test')

$ pwd
/data/musikk/dir
$ setfacl -b .
$ setfacl -m u:bhm:rwx,u:test:rwx,m:rwx .
$ setfacl -dm u:bhm:rwx,u:test:rwx,m:rwx .
$ getfacl .
# file: .
# owner: bhm
# group: bhm
user::rwx
user:bhm:rwx
user:test:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:bhm:rwx
default:user:test:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

$ su -s /bin/bash test
Password: 
test@hva:/data/musikk/dir$ mkdir testdir
test@hva:/data/musikk/dir$ getfacl testdir
# file: testdir
# owner: test
# group: test
user::rwx
user:bhm:rwx
user:test:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:bhm:rwx
default:user:test:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

Answer 3

The problem is with the mask not being set by default for some reason. I can't see why it's happening, but it might be better to not set it. Try missing the m:rwx out and then try.