Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want both my users 'tobias' and 'www-data' to be able to read and write to a specific directory.

To that end I have chowned it to tobias:www-data, added tobias to the www-data group and added setguid to the directory. Files and subdirectories are correctly created with www-data group owning them.

The next step is, as I understand it, using ACL to have a certain umask for this specific directory. I want it to be 002, so that content are given rw-rw-r permission. So I added 'acl' to my mount in /etc/fstab and remounted the disk. So far so good.

Here is the ACL configuration for my directory:

$ getfacl app/cache/
# file: app/cache/
# owner: tobias
# group: www-data
# flags: -s-

But even with my ACL set up it still creates new files and subdirectories with rw-r--r-- permission. So either I have done something wrong or I have misunderstood the concept. Could anyone please help me figure out which and what I should do to make it work?

share|improve this question
Can you do a getfacl on a file created under the directory ? Your ACL looks good to me. However, depending on who or what creates the file, something could change the permissions like an explicit chmod. – Urgoll Jul 23 '11 at 17:55
It turns out the problem was that my home directory, where I was testing, was on a mount of its own... I had ACL enabled for / and there it actually worked exactly as I wanted. So - this is a non-issue. Thanks for trying to help though! – Tobias Sjösten Jul 25 '11 at 9:00
up vote 1 down vote accepted

It seems to work here:

ubuntu-amd64% id | tr ',' '\n' | grep www-data
ubuntu-amd64% mount | grep ' / '
/dev/sda1 on / type ext4 (rw,errors=remount-ro,acl)
ubuntu-amd64% sudo sh
ubuntu-amd64# cd /var/www
ubuntu-amd64# mkdir -p app/cache
ubuntu-amd64# chown fission:www-data app/cache
ubuntu-amd64# chmod 2775 app/cache
ubuntu-amd64# ls -ld app/cache
drwxrwsr-x 2 fission www-data 4096 2011-07-23 11:21 app/cache
ubuntu-amd64# setfacl -dm u::rwx,g::rwx,o::rx app/cache
ubuntu-amd64# getfacl app/cache
# file: app/cache
# owner: fission
# group: www-data
# flags: -s-

ubuntu-amd64# exit
ubuntu-amd64% umask
ubuntu-amd64% touch /var/www/app/cache/test
ubuntu-amd64% ls -l /var/www/app/cache/test
-rw-rw-r-- 1 fission www-data 0 2011-07-23 11:23 /var/www/app/cache/test

To be honest, I don't know much about Linux ACLs, but it seems to me that the mask option isn't what you need – it should be enough for the default:{user,group,other} options to be set as above.

share|improve this answer
It did work for me after all, I just hadn't enabled ACL for the correct mount... Sorry about that. I would have upvoted you for the suggestion to use defaults instead but I'm apparently not reputable enough yet. – Tobias Sjösten Jul 23 '11 at 20:59
I upvoted your comment – hopefully that gives you some more reputation. ;-) Glad to hear it's working. – fission Jul 23 '11 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.