Home / server / Questions / 972467
In Process
bbarker
Asked: 2019-06-22 17:04:08 +0800 CST

Why can't user X write to directory despite having default:user:X:rwx ACL on the directory?

  • 772

As I understand it, this all looks good: iammedemo owns the directory, but iammme has default:user:iamme:rwx, so if anything, iamme should effectively be just as privileged as iammedemo, and be able to do anything in the directory:

[iamme@iamme-demo:~/IAMME]$ ls -last /tmp/badDir                                                  
total 28
 4 drwxr-xr-x+   2 iammedemo users  4096 Jun 22 00:50 .
24 drwxrwxrwt  220 iamme     users 20480 Jun 22 00:50 ..

[iamme@iamme-demo:~/IAMME]$ getfacl /tmp/badDir                                                   
getfacl: Removing leading '/' from absolute path names
# file: tmp/badDir
# owner: iammedemo
# group: users
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:iamme:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

But, I must be missing something:

[iamme@iamme-demo:~/IAMME]$ touch /tmp/badDir
touch: setting times of '/tmp/badDir': Permission denied                                       

[iamme@iamme-demo:~/IAMME]$ touch /tmp/badDir/foo                                                 
touch: cannot touch '/tmp/badDir/foo': Permission denied
linux

1 Answers

  1. This is a symptom of having only given default ACLs on the directory, which provides ACLs for new files created by e.g. the owner of the directory. You also have to provide ACLs for the directory itself.

    So you would need both

    sudo setfacl -d -m "user:iammedemo:rwX" /tmp/badDir
sudo setfacl    -m "user:iammedemo:rwX" /tmp/badDir # Notice the missing -d
    • 1