I've got some legacy code which checks that some file is read-only and readable only by it's owner, i.e. permissions set to 0400. I also need to give read-only access to this file to some other user on the system. I'm trying to set extended ACLs, but this changes 'regular' permission bits in a strange way also:

$ ls -l hostkey.pem 
-r-------- 1 root root 0 Jun  7 23:34 hostkey.pem
$ setfacl -m user:apache:r hostkey.pem 
$ getfacl hostkey.pem 
# file: hostkey.pem
# owner: root
# group: root

$ ls -l hostkey.pem 
-r--r-----+ 1 root root 0 Jun  7 23:34 hostkey.pem

And after this the legacy code starts complaining that the file is group-readable (while it is actually not!)

Is it possible to set the extended ACLs in such a way that some other user will also have read-only access, while the file will appear to have only 0400 'regular' permissions?


We've seen something like this in our experiments with Linux ACLs, especially via Samba. But in most cases, even though the regular permission/file mode bits are changed in strange ways, the system still performs overall as intended.

I remember reading somewhere (can't remember where, sorry) that when creating files (possibly via Samba) that the ACL permissions weren't properly reflected in the mode bits until data was written to the file. This would affect files created using, e.g., touch.

Something else to consider is whether you might want to set default ACLs.

We use something like this when creating new directory with ACL-protected files; the last command, with getfacl piped into setfacl, copies the currently-set ACLs to be used as default ACLs for new files created in this directory:

chown --recursive $username:$userrole /home/data/private/$datadir
chmod --recursive u=rwx,g=,o= /home/data/private/$datadir

# remove previous ACLs
setfacl --recursive --remove-all /home/data/private/$datadir

# User/group access for owner, group leader and web server
setfacl --recursive -m u:$username:rwx /home/data/private/$datadir
setfacl --recursive -m g:RGLeader:rx /home/data/private/$datadir
setfacl --recursive -m u:www-data:rwx /home/data/private/$datadir

# Copy access modes to default access modes
getfacl --access /home/data/private/$datadir | setfacl --recursive -d -M- /home/data/private/$datadir
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.