Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Debian 7.0 I've setup filesystem access control lists on my mount

mx:/srv/www$ mount | grep acl
/dev/xvda on / type ext3 (rw,relatime,errors=remount-ro,acl,data=ordered)

Now I simply want newly created files and dirs to have the www-data group.

sudo setfacl -Rm d:g:www-data:rX,g:www-data:rX /srv/www/

Now it has the settings:

mx:/srv/www$ getfacl .                                                                                                                                                    
# file: .
# owner: hendry
# group: root

To test, I did a:

mx:/srv/www$ touch test
mx:/srv/www$ ll test
-rw-r--r--+ 1 hendry hendry 0 Mar 19 07:25 test

I was expecting to see hendry:www-data upon the newly created file test. What am I missing?

share|improve this question
up vote 0 down vote accepted

Try running:

$ getfacl test

You should see something that look like:

# file: test
# owner: hendry
# group: hendry
user::rwx          #effective: rw-
group::r-x         #effective: r--
group:www-data:r-x #effective: r--

I might have gotten some things wrong here, but the main point is that group:www-data:r-x should exist. That's what the default:group:$gid:rwx syntax does -- it makes sure a group:$gid:rwx ACL entry exists on the create object.

If you want your created files/directories/fifos/etc to be owned by the group, you have to make the directory owned by the www-data group, and set the setgid flag:

$ chown :www-data /srv/www
$ chmod g+s /srv/www
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.