I have a user that I use for backup, and I use
setfacl to give that user access to files. However,
setfacl changes the base ACL entry for group and some applications require that the base ACL entry for group be
0 (no read, write, nor execute). Is there a way I can give the backup user read access without the applications getting uppity? An example below of how
setfacl and the base ACL entries interfere:
user@host:/tmp$ umask 0077 user@host:/tmp$ touch a user@host:/tmp$ ls -l a -rw------- 1 user user 0 2012-02-01 16:28 a user@host:/tmp$ setfacl -m u:nobody:rX a user@host:/tmp$ ls -l a -rw-r-----+ 1 user user 0 2012-02-01 16:28 a user@host:/tmp$ chmod 600 a user@host:/tmp$ getfacl a user:nobody:r-- #effective:---
EDIT: I could use root as my backup user, but I don't think I should. I'm using rsnapshot (using rsync (using ssh)) to backup to a remote system, and I think I would have to PermitRootLogin to ssh or make my backup user uid 0. Additionally, I'd like the backup to be automated, which I'm currently doing with ssh keys. Although I don't mind if the backup system has read access to the backed-up system, I would mind if it had write access.