I tested your example and got a different result. Here are the commands and output I did.
sudo adduser user1
sudo adduser user2
sudo -i -u user1 #basically the same thing as sudo su user1
mkdir /tmp/NNHD
setfacl --set user::rwx,user:user1:rwx,user:user2:rwx,group::r-x,mask:rwx,other::---,default:user::rwx,default:user:user1:rwx,default:user:user2:rwx,default:group::rwx,default:mask::rwx,default:other::--- /tmp/NNHD
getfacl /tmp/NNHD
Output:
getfacl: Removing leading '/' from absolute path names
# file: tmp/NNHD
# owner: user1
# group: user1
user::rwx
user:user1:rwx
user:user2:rwx
group::r-x
mask::rwx
other::---
default:user::rwx
default:user:user1:rwx
default:user:user2:rwx
default:group::rwx
default:mask::rwx
default:other::---
exit
sudo -i -u user2 #basically the same thing as sudo su user2
touch /tmp/NNHD/test
getfacl /tmp/NNHD/test
Output:
getfacl: Removing leading '/' from absolute path names
# file: tmp/NNHD/test
# owner: user2
# group: user2
user::rw-
user:user1:rwx #effective:rw-
user:user2:rwx #effective:rw-
group::rwx #effective:rw-
mask::rw-
other::---
ls -l /tmp/NNHD/test
Output:
-rw-rw----+ 1 user2 user2 0 Sep 6 15:14 /tmp/NNHD/test
---- begin code to clean up and undo our changes ----
exit
sudo deluser --remove-home user1
#sudo groupdel user1 #Despite getting a warning about group user1 has no more members, the group seems to get deleted on its own when removing the user, so deleting the group manually is unnecessary.
sudo deluser --remove-home user2
#sudo groupdel user1 #Despite getting a warning about group user2 has no more members, the group seems to get deleted on its own when removing the user, so deleting the group manually is unnecessary.
sudo rm -r /tmp/NNHD
---- end code to clean up and undo our changes ----
The output I got when doing /getfacl /tmp/NNHD/test makes more sense to me, because https://linux.die.net/man/5/acl says that when creating a file in a directory that has a default ACL, this is how the ACL on the new file is generated:
- The new object inherits the default ACL of the containing directory as its access ACL.
- The access ACL entries corresponding to the file permission bits are modified so that they contain no permissions that are not contained in the permissions specified by the mode parameter.
So, after step 1, every permission on NNHD/test would be rwx except other would be ---. Touch by default sets new files to rw-rw-rw permissions though, so after step 2, user::rw- makes sense since the user can't have more than rw-. I'm brand new to access control lists (and so maybe everything I'm saying is wrong) and I'm not sure exactly why group::rwx is what it is. I would have thought step 2 would have changed group:: to rw- just like step 2 set user:: to rw-. I would guess that step 2 just modifies the mask instead of modifying group::, but I'm not sure.