Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to set ACLs so that the user and group of new files and directories created in the web server directory are owned by the www-data user. I have the exact same ACL on another server and they work fine.

andrew@sona:/srv/www$ getfacl .
# file: .
# owner: www-data
# group: www-data
user::rwx
group::rwx
group:www-data:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:www-data:rwx
default:mask::rwx
default:other::r-x

andrew@sona:/srv/www$ mount | grep acl
/dev/xvda on / type ext3 (rw,noatime,errors=remount-ro,acl)
andrew@sona:/srv/www$ touch test.txt
andrew@sona:/srv/www$ ll
total 12
drwxrwxr-x+ 3 www-data www-data 4096 Sep  3 17:14 ./
drwxr-xr-x+ 3 root     root     4096 Sep  1 19:36 ../
-rw-rw-r--+ 1 andrew   andrew      0 Sep  3 17:14 test.txt

Server is Ubuntu 12.04 LTS

Distributor ID: Ubuntu
Description:    Ubuntu 12.04.3 LTS
Release:    12.04
Codename:   precise
share|improve this question
1  
serverfault.com/questions/460262/… This may be of help? –  Darius Sep 5 '13 at 15:55
    
The ACLs above (as far as I'm aware) shouldn't require you to set gid but should have the same effect… –  Prydie Sep 6 '13 at 17:04
add comment

1 Answer

up vote 3 down vote accepted
+50

Access control lists (ACL) provide a fine-grained mechanism to control the access to a file/directory. They don't change or define the ownership.

The default value defines which ACL a new created file inside that directory should "inherit". These seems to work for /srv/www, because your new created file test.txt gets some ACL (notice the + in the directory listing).

The essentials to accomplish your goal are given in the SF answer linked by @Darius:

chmod ug+s /srv/www

which sets the set-user-ID and set-group-ID bit. The info manual of coreutils explains this mechanism:

27.5 Directories and the Set-User-ID and Set-Group-ID Bits

On most systems, if a directory's set-group-ID bit is set, newly created subfiles inherit the same group as the directory, and newly created subdirectories inherit the set-group-ID bit of the parent directory. On a few systems, a directory's set-user-ID bit has a similar effect on the ownership of new subfiles and the set-user-ID bits of new subdirectories. (...)

Please note the constraint "on a few systems" for the set-user-ID bit. Indeed, neither on my Debian nor my openSuSE system the inheritance of the owner works, only the group is propagated. According to Wikipedia, this is true for all linux systems:

The setuid permission set on a directory is ignored on UNIX and Linux systems.[4] FreeBSD can be configured to interpret it analogously to setgid, namely, to force all files and sub-directories to be owned by the top directory owner.[5]

share|improve this answer
    
So when you have default:group:www-data:rwx that's the default permissions that should be defined for a file created by members of that group? –  Prydie Sep 15 '13 at 18:23
    
No, that means, that if a file/dir is created, it will have the ACL entry group:www-data:rwx -- independent who created the file. Check with getfacl test.txt for example, you'll see that all default entries of the directory show up. –  mpy Sep 15 '13 at 18:27
    
Does that not imply then that the group of the file should be www-data? I'm confused as to what function allowing you to specify the group in a default rule has if this is not the case. –  Prydie Sep 15 '13 at 18:55
    
@Prydie Default ACL entries work like normal ACL entries. The group:www-data: part specifies who should get the following permissions. –  Blacklight Shining Sep 15 '13 at 19:00
    
@Prydie: This article is a really good introduction to ACL, it surely explains the concepts better than I. (I think this documents was also my start into the world of Linux ACL...) –  mpy Sep 15 '13 at 19:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.