2

Will ACL adds override existing group permissions? We added rx to a directory tree for group myusergroup with the command blow. 

setfacl -Rm "g:myusergroup:rx" /opt/oracle/admin'
setfacl -Rdm "g:myusergroup:rx" /opt/oracle/admin'

But any user in group dba does NOT have write permissions in newly created directories even though directories show 775 permissions, the effective permission for group is not.

What am I missing?

$ ls -ld my_backup

drwxrwxr-x+ 2 oracle dba 4096 Apr 21 08:44 my_backup

$ getfacl my_backup

file: my_backup
owner: oracle
group: dba
user::rwx
group::r-x
group:edmuser:r-x
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:myusergroup:r-x
default:mask::r-x
default:other::r-x

$ touch ./my_backup/test.txt
touch: cannot touch `./my_backup/test.txt': Permission denied

$ id
uid=4000(exagrid) gid=40000(dba) groups=40000(dba)

(edit: reformatted)

Improve this question
4
  • Hrm, I am not great with ACLs, but I believe group::r-x and default:group::r-x are the problem. – Zoredache Apr 21 '17 at 16:46
  • Suggest rephrasing the question to reflect your end goal. "How do I use setfacl to allow two groups access to a folder and its contents?" Zoredache is right, the ACL permissions are basically 555. – Xalorous Apr 21 '17 at 16:54
  • @Zoredache is correct. No group write permission. – fpmurphy Apr 22 '17 at 4:01
  • so ACL does override dir permissions :o – Jean Monet Jan 7 at 20:08
1

So even though ls -ld shows group dba should have write permission on dir my_backup

 drwxrwxr-x+ 2 oracle dba 4096 Apr 21 08:44 my_backup

The ACL is overriding this. So if you want to keep write access for dba, you need add that to your ACL group permissions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.