setfacl to reset file to default permissions?

Question

I have a directory with the following default ACLs:

default:user:phptutor:rwx

However, none of the files/directories in that directory have that default permission (because it was added after they were created).

How can I copy the default ACLs of a parent directory to every folder and file in it?

Answer 1

Use getfacl to get the default permissions from the directory and then pipe the result into setfacl to apply it. Something like this should work:

getfacl -d <directory> | setfacl -R --set-file=- <directory>

Answer 2

I will extend this answer a bit further as in my case the default ACLs were created first but copying files with permissions did not apply the default ACLs (or to put it another way, the empty source ACLs were used).

Assuming all directories have the same default entries as the toplevel, restoring ACLs just as if files were created normally can be done in two steps:

1. Restore the default entries only. They will be applied to all directories, so that future files created under these sub-directories will inherit default ACLs.

   getfacl -d <directory> | setfacl -dR --set-file=- <directory>
   

2. Apply the default entries to all files and directories, but do not recalculate the mask (setfacl -n switch). The grep here also remove base UNIX permissions and mask entries, so setfacl can merge the ACLs with the current file permissions.

   getfacl -d <directory> | grep -v :: | setfacl -R -n -M- <directory>
   

The source and destination directory in those commands can be the same which is handy to apply missing ACLs on many files and directories directly under it (you will re-apply the same permissions to the top-level directory so effectively a no-op for that one).