Questions[setfacl](server)

(1)

nginx is run as "http":

$ sudo ps aux| grep nginx
root       10932  0.0  0.1  22264  1340 ?        Ss   18:27   0:00 nginx: master process /usr/bin/nginx -g pid /run/nginx.pid; error_log stderr;
http       10933  0.0  0.6  22796  6108 ?        S    18:27   0:00 nginx: worker process
user1      10939  0.0  0.2   6672  2680 pts/0    S+   18:28   0:00 grep nginx

(2)

permissions for the appropriate group:

$ sudo setfacl -m g:http:rwx -R ~/web_apps/my_app1

$ sudo getfacl ~/web_apps/my_app1
# file: home/user1/web_apps/my_app1
# owner: user1
# group: user1
user::rwx
group::r-x
group:http:rwx
mask::rwx
other::r-x

(3)

Yet, when accessed from internet, nginx won't be able to serve any file due to absense of necessary permissions

[error] 10933#10933: *1 open() "/home/user1/web_apps/my_app1/assets/static/favicon.ico" 
    failed (13: Permission denied), 
    client: x.x.x.x, server: my_app1.com,
    request: "GET /favicon.ico HTTP/2.0",
    host: "my_app1.com",
    referrer: "https://my_app1.com/assets/static/fdsafdsafds"

What's the matter?

This scratch file was created by apache

-rw-rw-r--+  1 apache apache   1960 Nov 16  2019 zlz7v5y9.php

When executing the following:

-bash-4.2$ rm zlz7v5y9.php

I get:

rm: cannot remove ‘zlz7v5y9.php’: Permission denied

Here are the permissions:

-bash-4.2$ getfacl zlz7v5y9.php
# file: zlz7v5y9.php
# owner: apache
# group: apache
user::rw-
user:tomr:rwx               #effective:rw-
user:subtum:rwx             #effective:rw-
group::rwx                  #effective:rw-
mask::rw-
other::r--

Oddly, I CAN edit the file but cannot delete it.

Why am I getting "Permission denied" when trying to delete this file?

UPDATE: Reissuing the setfacl command for a single user fixed the issue for BOTH users. Apparently the ACL system had died and setfacl woke it up? Even though it is working correctly now, I would like to know how this happened for the future. BTW, this is on a system that has had the same ACL config for years and suddenly it stopped working with no changes.

UPDATE#2: This issue keeps reappearing. I'm wondering if somehow a hacker has gotten in and is causing this. However, I run tripwire and do not see any suspicious system changes.

I am deploying an Nodejs Express app. It is going to run as on the same box as an Nginx server, which will proxy requests to it via a unix socket. The question is not specific to Nodejs, however.

The express app runs as user nodejs, and nginx runs as nginx.

My plan is to create a /sockets directory owned by nodejs for Express to put sockets in, and to grant nginx access to those sockets via a default ACL on the directory. Feel free to tell me if this is a silly idea, but keep in mind that's not my core question.

I create ACLs on the directory by running, as root,

setfacl -Rd --mask -m nginx:rw  /sockets
setfacl -R  --mask -m nginx:rwX /sockets

The directory then has the following ACLs: (tabulation by me for legibility in the question)

# file: /sockets
# owner: nodejs
# group: root
user:      : rwx
user: nginx: rwx
group:     : r-x
mask:      : rwx
other:     : r-x
default: user:     :rwx
default: user:nginx:rw-
default:group:     :r-x
default: mask:     :rwx
default:other:     :r-x

If, running as nodejs, I write to a file, it is created appropriately:

sudo -su nodejs
touch /sockets/testFile
getfacl /sockets/testFile

# file: /sockets/testFile
# owner: nodejs
# group: nodejs
user:     :rw-
user:nginx:rw-
group:    :r-x                      #effective:r--
mask:     :rw-
other:    :r--

Great!

However, if Node creates a socket by calling listen() on a path in this directory , it is created with an ACL mask that prevents nginx from accessing it.

const e = require('express')()
e.listen('/sockets/testSocket', (e) => console.error(e))

getfacl /sockets/testSocket 
# file: /sockets/testSocket
# owner: nodejs
# group: nodejs
user:     :rwx
user:nginx:rw-                  #effective:r--
group:    :r-x
mask:     :r-x
other:    :r-x

If I create an ordinary file with Nodejs in /sockets (e.g. by fs.writeFile) it is created with the same permissions as when I ran touch /sockets/testFile above, so I don't think it's a problem of Node's umask.

Likewise, if I run equivalent code to bind to a socket in python, the results are the same, so I don't think it's a problem with Node itself.

Obviously, this is stopping Nginx from talking to my Express app. Can anyone work out why? :/ The server is running CentOS 7.

Using setfacl command line arguments, is there a way to set/unset a single flag as the following command will do ?

chmod g+x FILE

Please note that:

setfacl g::x   FILE
setfacl g::--x FILE

are equivalent and will set executable bit and remove read a write flag. And thus these commands are not setting/unsetting an individual flag but 3 flags at once.

With Linux ACL, can you have multiple groups with default access to a folder? I want this for sharing code repositories between different coding groups + several processes. My thinking is, if a user from one group creates contents inside the shared repository, even though the owner is that user, the default permissions are propagated to that new file and the other users can still access the contents.

Here's what I tried as root:

mkdir /tmp/temp
chmod 770 /tmp/temp
setfacl -dm g:www-data:r-x,g:sambashare:r-x /tmp/temp
getfacl /tmp/temp

# file: temp
# owner: root
# group: root
user::rwx
group::rwx
other::---
default:user::rwx
default:group::rwx
default:group:www-data:r-x
default:group:sambashare:r-x
default:mask::rwx
default:other::---

As testuser

id
uid=1004(testuser) gid=1007(testuser) groups=1007(testuser),110(sambashare)
cd /tmp/temp
bash: cd: temp: Permission denied

So clearly not working as I expected. Can anyone help me understand why it's not working and how I can fix this?

P.S. I'm setting default group permissions instead of just the regular group permission because those are supposed to propagate to children.

 setfacl -m g:sambashare:r-x /tmp/temp

Thanks.