2

I want both my users 'tobias' and 'www-data' to be able to read and write to a specific directory.

To that end I have chowned it to tobias:www-data, added tobias to the www-data group and added setguid to the directory. Files and subdirectories are correctly created with www-data group owning them.

The next step is, as I understand it, using ACL to have a certain umask for this specific directory. I want it to be 002, so that content are given rw-rw-r permission. So I added 'acl' to my mount in /etc/fstab and remounted the disk. So far so good.

Here is the ACL configuration for my directory:

$ getfacl app/cache/
# file: app/cache/
# owner: tobias
# group: www-data
# flags: -s-
user::rwx
user:www-data:rwx
user:tobias:rwx
group::rwx
mask::rwx
other::r-x
default:user::rwx
default:user:www-data:rwx
default:user:tobias:rwx
default:group::rwx
default:mask::rwx
default:other::r-x

But even with my ACL set up it still creates new files and subdirectories with rw-r--r-- permission. So either I have done something wrong or I have misunderstood the concept. Could anyone please help me figure out which and what I should do to make it work?

2
  • Can you do a getfacl on a file created under the directory ? Your ACL looks good to me. However, depending on who or what creates the file, something could change the permissions like an explicit chmod.
    – Urgoll
    Jul 23, 2011 at 17:55
  • It turns out the problem was that my home directory, where I was testing, was on a mount of its own... I had ACL enabled for / and there it actually worked exactly as I wanted. So - this is a non-issue. Thanks for trying to help though! Jul 25, 2011 at 9:00

1 Answer 1

1

It seems to work here:

ubuntu-amd64% id | tr ',' '\n' | grep www-data
33(www-data)
ubuntu-amd64% mount | grep ' / '
/dev/sda1 on / type ext4 (rw,errors=remount-ro,acl)
ubuntu-amd64% sudo sh
ubuntu-amd64# cd /var/www
ubuntu-amd64# mkdir -p app/cache
ubuntu-amd64# chown fission:www-data app/cache
ubuntu-amd64# chmod 2775 app/cache
ubuntu-amd64# ls -ld app/cache
drwxrwsr-x 2 fission www-data 4096 2011-07-23 11:21 app/cache
ubuntu-amd64# setfacl -dm u::rwx,g::rwx,o::rx app/cache
ubuntu-amd64# getfacl app/cache
# file: app/cache
# owner: fission
# group: www-data
# flags: -s-
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x

ubuntu-amd64# exit
ubuntu-amd64% umask
022
ubuntu-amd64% touch /var/www/app/cache/test
ubuntu-amd64% ls -l /var/www/app/cache/test
-rw-rw-r-- 1 fission www-data 0 2011-07-23 11:23 /var/www/app/cache/test

To be honest, I don't know much about Linux ACLs, but it seems to me that the mask option isn't what you need – it should be enough for the default:{user,group,other} options to be set as above.

2
  • 1
    It did work for me after all, I just hadn't enabled ACL for the correct mount... Sorry about that. I would have upvoted you for the suggestion to use defaults instead but I'm apparently not reputable enough yet. Jul 23, 2011 at 20:59
  • I upvoted your comment – hopefully that gives you some more reputation. ;-) Glad to hear it's working.
    – fission
    Jul 23, 2011 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.