Re: Group ACLs: Am I confused, or is this a problem?

So I *was* confused. So in order to achieve what I'm after I set both
the ACL and the default ACL recursively on existing folders, and after
that files and folders get the correct permissions? It certainly appears
that way, though I admit I might be doing more than is necessary.

Thanks for your help Andreas, I like your 'give them a clue, but
otherwise tell them to RTFM' approach.

Cheers!
Paul

On Wed, 2005-08-10 at 08:00 +0200, Andreas Gruenbacher wrote:
> On Wednesday 10 August 2005 05:53, Paul Dorman wrote:
> > I'm probably confused :o)
> >
> > Hello there, this mailing list has far too little traffic. I must
> > contribute...
> >
> > I'm running Debian Sarge servers with ReiserFS and ACL code compiled in.
> > I would like a members of the group 'staff' to have rw access to files
> > below /var/www/, whilst keeping the ownership of the files and
> > directories at root.www-data, with default permissions of 0755.
> >
> > I did 'setfacl -m -d g:staff:rwx /var/www', but get permission denied if
> > I try to create anything inside /var/www/ as one of the members of group
> > staff. 'getfacl www' gets:
> >
> > # file: var/www
> > # owner: root
> > # group: www-data
> > user::rwx
> > group::r-x
> > mask::r-x
> > other::r-x
> > default:user::rwx
> > default:group::r-x
> > default:group:staff:rwx
> > default:mask::rwx
> > default:other::r-x
> >
> > As one of the members of group staff, ls -ld /var/www gets:
> >
> > drwxr-sr-x+ 3 root www-data 112 Aug 10 15:09 www
> >
> > I think it should look like:
> >
> > drwxrwsr-x+ 3 root www-data 112 Aug 10 15:09 www
> >
> > However, if I do 'setfacl -m u:<user>:rwx /var/www' I can create files
> > and directories inside of /var/www. Running ls as this user get's what I
> > hoped above.
> >
> > Could someone please tell me what I'm doing wrong here?
> 
> See the manual pages:
> 
> $ man acl
> [...]
> ACL TYPES
>      Every object can be thought of as having associated with it an ACL that
>      governs the discretionary access to that object; this ACL is referred to
>      as an access ACL. In addition, a directory may have an associated ACL
>      that governs the initial access ACL for objects created within that
>      directory; this ACL is referred to as a default ACL.
> 
> $ man setfacl
> [...]
>        -d, --default
>            All operations apply to the Default ACL. Regular ACL entries in the
>            input  set are promoted to Default ACL entries. Default ACL entries
>            in the input set are discarded. (A warning is issued if  that  hap-
>            pens).
> 
> -- Andreas.

_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel