Re: getfacl doesn't show same output as ls?

Hi Scott,

On Mon, Jun 07, 2004 at 10:51:40PM -0400, Scott Mcdermott wrote:
> > > I do not understand why `ls -l' shows ACL_GROUP_OBJ having
> > > the write bit, but the "group::r-x" in getfacl(1) shows it
> > > without?
> > 
> > The group permissions in 'ls -l' show the ACL_MASK rather
> > than ACL_GROUP_OBJ.  The man page mentions this under the
> > section "CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE
> > PERMISSION BITS".
> 
> I read that about six times and did not see it, thank you
> for pointing it out.
> 
> using the group bits for ACL_MASK is a somewhat bizarre
> change from ordinary permissions...

This is probably one of the most common confusing things with ACLs :)
Worth checking out Section B.23.3.6 (Annex B) of std on this one if
you want justifications of why it was done that way.

I wrote in April 2003:
> I believe it is doing the right thing according to the standard.
> It is a very common query about the syncing between the file group
> permission bits and the mask ace.
> I don't think it is something that one would expect but they
> have made some justifications (see below for reference).
> 
> Previously I wrote:
>     XFS ACLs are based on the Posix 1003.1e draft standard 17 (Section 23).
>         This withdrawn Posix ACL standard can be downloaded at:
>              http://wt.xpilot.org/posix.1e/download.html
>         Andreas Grünbacher's site: http://acl.bestbits.at/
>         is also a useful resource.
>     So if you are going to use ACLs it is worth doing some ACL reading :)
>     ...
>     Checkout the section 23.1.2 (Relationship with File permission Bits)
>     to see how the ACL ACEs match up with the standard file permission  
>     bits.
>     In particular one would note that the group permission bits
>     reflect the Mask permission bits when a Mask ACE exists
>     and Section B.23.3.6 (in Annex B) discusses reasons why this
>     scheme was chosen.
>     (Also worthy of note, is that if you create a file whose parent dir
>      has a default ACL, then it's ACE permissions are set by the
>      _intersection_ of the respective default ACEs permission bits and
>      the mode bits of the parameter to open/creat.
>      If you have a MASK ACE (section 5.3.1.2), then the
>      ACE permissions on the new file will have a MASK ACE equal to
>      the intersection of the default MASK ACE permission bits
>      and the standard group permission bits of the parameter to open/creat.)
>     --Tim

--Tim
_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel