When setting the permissions on a file that does not have extended ACLs set, the 'user', 'group' and 'other' permissions are set. This can be seen with
$ touch testfile $ chmod 600 testfile $ getfacl testfile # file: testfile # owner: blah # group: blah user::rw- group::--- other::---
However, when extended ACLs are set on the file, for example to provide a certain user read access, then
chmod is used to change the (normal) permissions on the file, something odd happens:
$ touch testfile #0644 permissions $ setfacl -m u:otherusr:r-- testfile $ chmod 600 testfile $ getfacl testfile # file: testfile # owner: blah # group: blah user::rw- user:otherusr:r-- #effective:--- group::r-- #effective:--- mask::--- other::---
Notice how the 'group' permissions were untouched - instead the
chmod changed the 'mask' of the file. Unfortunately this in turn prevents the 'otherusr' user from getting the access they are supposed to have, due to the now restrictive mask.
Is there any reason that
chmod has this behaviour? I know that it is not designed to work with extended ACLs, but surely it should just set the 'group' rather than the 'mask'?