Re: Group ACLs: Am I confused, or is this a problem?

On Wednesday 10 August 2005 05:53, Paul Dorman wrote:
> I'm probably confused :o)
>
> Hello there, this mailing list has far too little traffic. I must
> contribute...
>
> I'm running Debian Sarge servers with ReiserFS and ACL code compiled in.
> I would like a members of the group 'staff' to have rw access to files
> below /var/www/, whilst keeping the ownership of the files and
> directories at root.www-data, with default permissions of 0755.
>
> I did 'setfacl -m -d g:staff:rwx /var/www', but get permission denied if
> I try to create anything inside /var/www/ as one of the members of group
> staff. 'getfacl www' gets:
>
> # file: var/www
> # owner: root
> # group: www-data
> user::rwx
> group::r-x
> mask::r-x
> other::r-x
> default:user::rwx
> default:group::r-x
> default:group:staff:rwx
> default:mask::rwx
> default:other::r-x
>
> As one of the members of group staff, ls -ld /var/www gets:
>
> drwxr-sr-x+ 3 root www-data 112 Aug 10 15:09 www
>
> I think it should look like:
>
> drwxrwsr-x+ 3 root www-data 112 Aug 10 15:09 www
>
> However, if I do 'setfacl -m u:<user>:rwx /var/www' I can create files
> and directories inside of /var/www. Running ls as this user get's what I
> hoped above.
>
> Could someone please tell me what I'm doing wrong here?

See the manual pages:

$ man acl
[...]
ACL TYPES
     Every object can be thought of as having associated with it an ACL that
     governs the discretionary access to that object; this ACL is referred to
     as an access ACL. In addition, a directory may have an associated ACL
     that governs the initial access ACL for objects created within that
     directory; this ACL is referred to as a default ACL.

$ man setfacl
[...]
       -d, --default
           All operations apply to the Default ACL. Regular ACL entries in the
           input  set are promoted to Default ACL entries. Default ACL entries
           in the input set are discarded. (A warning is issued if  that  hap-
           pens).

-- Andreas.
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel