Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several svn repositories in /projects/svn which should be writeable by 2 users, mine (unix), and wwwrun (apache, for svn over http)

newly created folders and file should be read/writeable by both users

i played around with setfacl but couldn't get it working the way i need it

my attempt was as follows:

unknown:/projects/svn # setfacl -b .
unknown:/projects/svn # setfacl -m u:unix:rwx,u:wwwrun:rwx,m:rwx .
unknown:/projects/svn # setfacl -dm u:unix:rwx,u:wwwrun:rwx,m:rwx .
unknown:/projects/svn # getfacl .
# file: .
# owner: unix
# group: users
user::rwx
user:wwwrun:rwx
user:unix:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:wwwrun:rwx
default:user:unix:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

unknown:/projects/svn # su -s /bin/bash wwwrun
wwwrun@unknown:/projects/svn> md test
wwwrun@unknown:/projects/svn> getfacl test
# file: test
# owner: wwwrun
# group: www
user::rwx
user:wwwrun:rwx                 #effective:r-x
user:unix:rwx                   #effective:r-x
group::r-x
mask::r-x
other::r-x
default:user::rwx
default:user:wwwrun:rwx
default:user:unix:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

wwwrun@unknown:/projects/svn>

as you can see, my user (unix) has only r-x (as effective) permissions

share|improve this question

3 Answers 3

The problem is with the mask not being set by default for some reason. I can't see why it's happening, but it might be better to not set it. Try missing the m:rwx out and then try.

share|improve this answer
    
now the mask is automatically calculated, which results in a default:mask:rwx and mask:r-x => again, effective permissions: r-x is what i want actually possible access control lists –  tkSimon Sep 5 '10 at 13:30

I cannot reproduce what you get; I get the expected behaviour whether I include the m:rwx or not. This is on a Linux Ubuntu 10.04 LTS (Lucid Lynx) with kernel 2.6.32-24-generic, the ext4 filesystem and setfacl v. 2.2.49: (Users 'bhm' and 'test')

$ pwd
/data/musikk/dir
$ setfacl -b .
$ setfacl -m u:bhm:rwx,u:test:rwx,m:rwx .
$ setfacl -dm u:bhm:rwx,u:test:rwx,m:rwx .
$ getfacl .
# file: .
# owner: bhm
# group: bhm
user::rwx
user:bhm:rwx
user:test:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:bhm:rwx
default:user:test:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

$ su -s /bin/bash test
Password: 
test@hva:/data/musikk/dir$ mkdir testdir
test@hva:/data/musikk/dir$ getfacl testdir
# file: testdir
# owner: test
# group: test
user::rwx
user:bhm:rwx
user:test:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:bhm:rwx
default:user:test:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
share|improve this answer
    
hm, that's strange, i run openSUSE 11.2, Linux 2.6.34.1-default, setfacl 2.2.48. I tried it again, with different users and different directories. i can't figure out why it doesn't work for me... –  tkSimon Sep 5 '10 at 13:46
up vote 2 down vote accepted

well, i should've just read the manual...

http://www.suse.de/~agruen/acl/linux-acls/online/#SECTION00040000000000000000
Section 'How ACLs Work'

my group bit was to restrictive (r-w), which restricted the mask to r-x, and subsequently the named users in my ACL could not write

actually, it's rather simple :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.