Non-working ACL configuration

Question

I want both my users 'tobias' and 'www-data' to be able to read and write to a specific directory.

To that end I have chowned it to tobias:www-data, added tobias to the www-data group and added setguid to the directory. Files and subdirectories are correctly created with www-data group owning them.

The next step is, as I understand it, using ACL to have a certain umask for this specific directory. I want it to be 002, so that content are given rw-rw-r permission. So I added 'acl' to my mount in /etc/fstab and remounted the disk. So far so good.

Here is the ACL configuration for my directory:

$ getfacl app/cache/
# file: app/cache/
# owner: tobias
# group: www-data
# flags: -s-
user::rwx
user:www-data:rwx
user:tobias:rwx
group::rwx
mask::rwx
other::r-x
default:user::rwx
default:user:www-data:rwx
default:user:tobias:rwx
default:group::rwx
default:mask::rwx
default:other::r-x

But even with my ACL set up it still creates new files and subdirectories with rw-r--r-- permission. So either I have done something wrong or I have misunderstood the concept. Could anyone please help me figure out which and what I should do to make it work?

Answer 1

It seems to work here:

ubuntu-amd64% id | tr ',' '\n' | grep www-data
33(www-data)
ubuntu-amd64% mount | grep ' / '
/dev/sda1 on / type ext4 (rw,errors=remount-ro,acl)
ubuntu-amd64% sudo sh
ubuntu-amd64# cd /var/www
ubuntu-amd64# mkdir -p app/cache
ubuntu-amd64# chown fission:www-data app/cache
ubuntu-amd64# chmod 2775 app/cache
ubuntu-amd64# ls -ld app/cache
drwxrwsr-x 2 fission www-data 4096 2011-07-23 11:21 app/cache
ubuntu-amd64# setfacl -dm u::rwx,g::rwx,o::rx app/cache
ubuntu-amd64# getfacl app/cache
# file: app/cache
# owner: fission
# group: www-data
# flags: -s-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x

ubuntu-amd64# exit
ubuntu-amd64% umask
022
ubuntu-amd64% touch /var/www/app/cache/test
ubuntu-amd64% ls -l /var/www/app/cache/test
-rw-rw-r-- 1 fission www-data 0 2011-07-23 11:23 /var/www/app/cache/test

To be honest, I don't know much about Linux ACLs, but it seems to me that the mask option isn't what you need – it should be enough for the default:{user,group,other} options to be set as above.