Linux – Handling file permissions in Linux with ACL

Try:

setfacl --recursive --modify u:foo:rwX,d:u:foo:rwX test

to modify the current ACL as well as the default. I believe "d:" only affects the (d)efault ACL of directories and leaves files untouched. Then, if you create a new file in the directory, it inherits the ACL of its parent directory via the default.

The corresponding linux commands are :

• ls : Any line with a + after permissions has ACLs on it ( rwxrwxrwx+ ).
• setfacl : Add / Modify ACLs on the file
• getfacl : Read ACLs on the file

Now, I don't know OSx all that well, but when I read those ACLs I see something different. To me, "group: everyone deny delete" would be a rule that states that members of the "everyone" group are denied the ability to delete files.

On linux, however, there is no such thing as "deny delete". The ability to delete is granted by the ability to write. Therefore, if you want to deny delete you also have to deny write which may not be exactly what you're looking for. Then again, you have to figure that it makes sense ... If I can write to a file, technically there is nothing preventing me from zeroing out the file's contents.

But with such a broad rule that seems to act as a catch all you don't really need ACLs at all. Just set the "other" permissions to r-- ( 0600 ) and users that are neither the owner, nor part of the owning group will be unable to write or execute the file. In your example that would mean anyone that is neither the user cb0 nor part of the group staff.

That being said, if you are interested in more indept information on ACLs and their respective commands, I would suggest you take a moment to carefully read through the POSIX Access Controls document : http://www.suse.de/~agruen/acl/linux-acls/online/