I know this question may appear to be a duplicate, because many people have asked related questions about permission inheritance. However, none of the answers I've found address the full scope of what I'm trying to accomplish, so here goes:
I have a "share" directory, on an ext4 filesystem on Debian stable, which contains subdirectories belonging to different users. Each user should have Read access to everything in the entire tree, and Read-Write access to their own sub-tree. The users are free to add files to their own sub-tree, and those files originate from an endless variety of sources I have no control over, so their existing permissions are inconsistent garbage that can be discarded without hesitation.
Thus far, I have created a "share" group and added the relevant users to it, then
chown -R set the group ownership to that "share" group and
chmod -R set the desired permissions... for all the files that are already in there. Using the SetGID bit, I can propagate the group ownership to newly created files, and using the "default" capability of Posix ACLs I can similarly propagate permissions to newly created files.
But! If an existing file is moved into the "share" directory tree from elsewhere, its existing GID and permissions/ACL take precedence and none of the above has any effect whatsoever. I understand that there are good and important reasons why this is the normal default behaviour of the filesystem (principle of least surprise, user-set permissions are generally chosen for a reason, etc.)... But in this case, for this particular directory tree, I want to override that behaviour.
I want to consistently, as promptly as possible (by force if necessary) apply a set of permissions and group ownership to all files, directories, and symlinks that come to be located in this directory tree, whether they get there by creation, move, copy, rsync, scp, unzip, untar, teleportation, orbital-drop, spontaneous quantum event, or any other means whatsoever.
I am root on this machine, and am willing to consider alternative filesystems, though only mature, production-ready filesystems that are well supported by Linux will be considered as candidates.
So far, the least awful way I can see to achieve this objective is to run some sort of inotify watcher (Watchman, maybe) as an always-on systemd service, to watch the whole tree recursively and call a script to chown and chmod files whenever the watcher detects changes. This is better than a timed job to blindly run
chown -R and
chmod -R over and over again, but it's still a crude and inefficient approach. Before I start implementing that ugly workaround, I'm really hoping somebody out there knows of a built-in capability of ext4 or some other applicable filesystem to handle this in an efficient and native way.