oddities in interference of linux extened ACLs and 'regular' permissions

Question

I've got some legacy code which checks that some file is read-only and readable only by it's owner, i.e. permissions set to 0400. I also need to give read-only access to this file to some other user on the system. I'm trying to set extended ACLs, but this changes 'regular' permission bits in a strange way also:

$ ls -l hostkey.pem 
-r-------- 1 root root 0 Jun  7 23:34 hostkey.pem
$ setfacl -m user:apache:r hostkey.pem 
$ getfacl hostkey.pem 
# file: hostkey.pem
# owner: root
# group: root
user::r--
user:apache:r--
group::---
mask::r--
other::---

$ ls -l hostkey.pem 
-r--r-----+ 1 root root 0 Jun  7 23:34 hostkey.pem

And after this the legacy code starts complaining that the file is group-readable (while it is actually not!)

Is it possible to set the extended ACLs in such a way that some other user will also have read-only access, while the file will appear to have only 0400 'regular' permissions?

Answer 1

We've seen something like this in our experiments with Linux ACLs, especially via Samba. But in most cases, even though the regular permission/file mode bits are changed in strange ways, the system still performs overall as intended.

I remember reading somewhere (can't remember where, sorry) that when creating files (possibly via Samba) that the ACL permissions weren't properly reflected in the mode bits until data was written to the file. This would affect files created using, e.g., touch.

Something else to consider is whether you might want to set default ACLs.

We use something like this when creating new directory with ACL-protected files; the last command, with getfacl piped into setfacl, copies the currently-set ACLs to be used as default ACLs for new files created in this directory:

chown --recursive $username:$userrole /home/data/private/$datadir
chmod --recursive u=rwx,g=,o= /home/data/private/$datadir

# remove previous ACLs
setfacl --recursive --remove-all /home/data/private/$datadir

# User/group access for owner, group leader and web server
setfacl --recursive -m u:$username:rwx /home/data/private/$datadir
setfacl --recursive -m g:RGLeader:rx /home/data/private/$datadir
setfacl --recursive -m u:www-data:rwx /home/data/private/$datadir

# Copy access modes to default access modes
getfacl --access /home/data/private/$datadir | setfacl --recursive -d -M- /home/data/private/$datadir