Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just started using setfacl to assign permissions for a specific group to /var/www/html (CentOS 5). Files in this directory are 640, root:apache. However, I've noticed that after doing something like:

setfacl -R -m g:developers:rwx /var/www/html
setfacl -R -m d:g:developers:rwx /var/www/html

... ls -al shows that a newly created file's owner and group are both set to my username.

Is there a way (using setfacl) to enforce newly created files to get the permissions of the ACLs AND then set the owner:group to root:apache? Or, alternatively, is this best done through a periodic cron job that does a chown -R root.apache /var/www/html down the entire DocumentRoot? Or... am I missing something else completely?

share|improve this question
Maybe it's sufficient to ensure that all files that get created are owned and writable by group developers? You could do that by setting the setgid bit on /var/www/html and using umask 002. – jjlin Jun 11 '12 at 21:40
The setfacl -R -m d:g:developers:rwx /var/www/html ensures that newly created files can be modified and deleted by anyone in developers. setgid is great for allowing apache to still see the files - doing a chmod g+s on the directory forces newly created files to be owned by username:apache instead of username:username. The actual owner isn't much of a problem because the only users that should be in that directory are a) in developers or b) root. Keeping /var/www/html as 750, root:apache (with the setgid bit) ensures users outside of developers can't get into the directory. – am4 Jun 12 '12 at 13:41

Make sure new files are owned by the developers group, set g+s and set the default permissions to read, write and execute.

chown -R :developers /var/www/html
chmod -R g+s /var/www/html
setfacl -d -m g::rwx /var/www/html
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .