Permissions, umask and ACLs

Goal

Set exact permissions, including for one specific group without changing ownership (ACLs).

POSIX

chmod 640 file             # rw-r-----
chmod u+x,g-w,o= script.sh
chown eric:devs /srv/app
chmod -R g+rX /srv/app     # X = executable only on directories

Special bits

chmod 2775 /srv/share      # setgid: new files inherit the group
chmod 1777 /tmp            # sticky: only the owner can delete
chmod 4755 /usr/local/bin/tool   # setuid: runs with the owner's rights

Check with ls -ld: s/t in the right places (rws, rwt, rwS = no x).

umask

umask            # 0022 by default: files 644, directories 755
umask 027        # files 640, directories 750

Persistent: /etc/profile.d/umask.sh or ~/.bashrc.

ACLs

setfacl -m u:eric:rw /srv/app/report.txt
setfacl -m g:audit:r-x /srv/app
getfacl /srv/app/report.txt
setfacl -x u:eric /srv/app/report.txt   # remove
setfacl -R -m d:g:devs:rwx /srv/share   # default ACL (inheritance)

ls -l shows a + when an ACL exists.

Verify

getfacl /srv/share 2>/dev/null | head
ls -ld /tmp /srv/share