I have two groups group1 and group2.

I need group1 users to be able to read-write (rwx) files owned by users in group2, but users in group2 cannot write to (r-x) files from group1.

All users in a group can read, but not write to, files on the same group (r-x)

I know that I can use ACL (Access Control Lists) to deal with it.

setfacl -m g:group1:rwx "directory owned by a group2 user"

the problem is that it must be set for every new folder. is there a way to set as default so that every new group2 user's file/folder have this permission applied?

will this default be applied if I create a new user in group2?

I know that the normal permissions are copied from /etc/skel to the home folder when a new user is created, but how to make the acl permissions to be copied too?

2 Answers 2


For default permissions its "-d". So you can use this:

setfacl -d -m g:group1:rwx "Main directory owned by group2 user"

Also do check the effective rights with getfacl. You may have to set the mask also.


You don't need ACLs.

Put all users from group1 also into group2. Then ensure you put the setgid bit the directories: all new files will owned by the directory owner, with similar permissions (setgid will be added to new subdirs).

# Setup as root
mkdir -p /tmp/test/1
chgrp group1 /tmp/test/1
chmod g+wsx,o= /tmp/test/1
mkdir -p /tmp/test/2
chgrp group2 /tmp/test/2
chmod g+ws,o= /tmp/test/2
# user1 is in groups users (primary gid), group1, group2 
# user2 is in groups users (primary gid), group2
# as user1:users
mkdir -p /tmp/test/{1,2}/d1
touch /tmp/test/{1,2}/{f1,d1/f1}
# as user2:users
mkdir -p /tmp/test/{1,2}/d2
touch /tmp/test/{1,2}/{f2,d2/f2}
# check the ownerships on everything
ls -la /tmp/test/{1,2}/{f{1,2},d{1,2},d{1,2}/f{1,2}}

If you do want to stick with ACLs, you need to look at default ACLs, you do similar to the above with them.

As for adding new users and /etc/skel/, I'm afraid you're out of luck there, the stock useradd command does not preserve any ACLs or xattrs when copying /etc/skel/.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.