using setfacl to give access to another user without giving access to a group

Question

I have a user that I use for backup, and I use setfacl to give that user access to files. However, setfacl changes the base ACL entry for group and some applications require that the base ACL entry for group be 0 (no read, write, nor execute). Is there a way I can give the backup user read access without the applications getting uppity? An example below of how setfacl and the base ACL entries interfere:

user@host:/tmp$ umask 0077
user@host:/tmp$ touch a
user@host:/tmp$ ls -l a
-rw------- 1 user user 0 2012-02-01 16:28 a
user@host:/tmp$ setfacl -m u:nobody:rX a
user@host:/tmp$ ls -l a
-rw-r-----+ 1 user user 0 2012-02-01 16:28 a
user@host:/tmp$ chmod 600 a
user@host:/tmp$ getfacl a
user:nobody:r--                 #effective:---

EDIT: I could use root as my backup user, but I don't think I should. I'm using rsnapshot (using rsync (using ssh)) to backup to a remote system, and I think I would have to PermitRootLogin to ssh or make my backup user uid 0. Additionally, I'd like the backup to be automated, which I'm currently doing with ssh keys. Although I don't mind if the backup system has read access to the backed-up system, I would mind if it had write access.

Answer 1

No. If a POSIX ACL is present, the Unix "group" permissions will be mapped to the ACL mask:: entry, which sets the maximum allowed permissions for all ACL entries, in order to not break compatibility with ACL-unaware tools. (See this answer on ServerFault for a detailed explanation.)