I use setfacl command to grant read permission for reading files in directory, but I cant use ls to view files. I tried setfacl -Rdm g:grouptoadd:rx /path/directory/ but, I can read files (when I use direct path to file for example "/path/directory/myfile) and can't list directory (ls /path/directory/)

I mounted an nfsv4 folder (both client and server are CentOS 7.4) via command $ sudo mount -t nfs -o v4.0,sec=krb5 ark-centos7-ker.qa.arkivio.com:/export/nfs1 /nfs4-mnt-dir created a file via: touch 11, then set file's ACL get failed with command $ sudo nfs4_setfacl -a A::auto-stor@qa.arkivio.com:rxtncy /nfs4-mnt-dir/11 [sudo] password for auto-stor@qa.arkivio.com: Failed setxattr operation: Invalid argument it seems complaining the parameter auto-stor@qa.arkivio.com is invalid, but this user is already recognized by both nfs4 client and server. $ getent passwd auto-stor@qa.arkivio.com auto-stor@qa.arkivio.com:*:1712401226:1712400513:auto-stor:/home/auto-stor@qa.arkivio.com:/bin/bash $ id auto-stor@qa.arkivio.com uid=1712401226(auto-stor@qa.arkivio.com) gid=1712400513(domain users@qa.arkivio.com) groups=1712400513(domain users@qa.a rkivio.com),10(wheel),1712439592(autostoradmins@qa.arkivio.com),1712439438(certsvc_dcom_access@qa.arkivio.com),171243989 6(passwordpropdeny@qa.arkivio.com),1712400512(domain admins@qa.arkivio.com),1712439802(ats_steph_testgroup@qa.arkivio.co m) What is missing in my configuration?

So here is something I could not find any reference to, I have this user, user_A, I want to remove its access to this directory entirely /log/dirA As far as I understand, chmod is used to modify the access in this order user/group/others. Others is general and does not care who this is, just anyone other than the user, while not a member of group will be "other(s)", so I don't want to mess with other users access to this path, but I want to limit user_A from accessing it. Does **setfacl** work for directories too? because I used this command, which I think should deny read/write/execute access of the mentioned Directory to the user_A, but the user is still able to cd into the mentioned dir. Does setfacl apply only to files?? Command:

setfacl -Rdm u:user_A:--- /log/dirA

ls -lhtr of the mentioned path:

rwxr-xr-x+  3 Mainuser Mainuser   19 Apr 17  2018 dirA

getfacl /log/dirA :

# file: dirA/
# owner: Mainuser
# group: Mainuser
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:user_A:---
default:group::r-x
default:mask::r-x
default:other::r-x

In my folder /var/www/storage/app/uploads/public I have a lot of subdirectories that are made by my website CMS and sftpupload script from a remote server. Now the problem I'm facing arises from the sftp upload created directories. The owner is sftpuser and there is no write permission on that directory for my www-data user to create a subdirectory. This causes my www-data user php script to spew out > Backtrace from 'mkdir(): Permission denied' at /var/www/install-master/vendor/laravel/framework/src/Illuminate/Filesystem/Filesystem.php 336: If I check the acl permissions on the parent directories from when I first set it to be group writable first, the topmost directory has correct acl permissions. But the second level, created by sftp doesn't have these I found this question , but not really a useful answer except that sftp ignores acls. I have tried setting the umask bit for sftp in /etc/ssh/sshd_config but even that didn't have an effect on the newly created directory. Still not writable for group. How do I use sftp to give browse and create subdirectories permissions to newly created folders for owner and group, read and write permissions for owner and group, but not execute permissions on the files in those subdirectories? Or should I use a different approach? As I understand it, sftp has only limited options on changing file permissions from the remote side, and acl are aparently ignored by openssh sftp. So how do I get these proper permissions running on ubuntu 18.04 with an sftpuser?

I have a directory that I would like to share with two specific users. It has no contents yet, but I need all three of us to be able to add files and subdirectories, and it's important that all contents (by default at least) inherit the same permissions. The three of us get full access--nobody else gets anything. I thought I'd accomplished this goal with:

setfacl -m u:myfriend:rwx Directory
setfacl -d -m u:myfriend:rwx Directory

But when I create a test file inside the directory, I see the following:

$$$ getfacl TESTFILE
# file: TESTFILE
# owner: me
# group: me
user::rw-
user:myfriend:rwx                     #effective:---
group::---
mask::---
other::---

I think the mask is the problem, but the mask on the directory doesn't match. This is what I get when I run getfacl on the Directory:

$$$ getfacl .
# file: .
# owner: me
# group: me
user::rwx
user:myfriend:rwx
group::---
mask::rwx
other::---
default:user::rwx
default:user:myfriend:rwx
default:group::---
default:mask::rwx
default:other::---

What am I doing wrong here? Thanks!

I'm using Mint Linux 22.1 and vsftpd on the destination computer and Windows 11 (latest version) as the source computer. I have the following permissions. In my home directory I have a symlink to a mounted NTFS drive: The permissions to the mounted NTFS drive's directories are: I have added FACL permissions to each directory making todd an owner of each directory (also did a chown from root to todd in a separate, unsuccessful attempt). **Upon further investigation it appears the setfacl didn't actually do anything (apparently due to the file system being NTFS). So, now the question becomes why didn't the chown where I set my user account as owner solve the problem?** I have set write_enable=YES in the /etc/vsftpd.conf file When I try accessing the symlink using Windows 11's file explorer: ftp://todd@192.168.40.77/NTFS2TB/backups/ I can see files and directories within the NTFS2TB directory, but I cannot upload any files into it. What do I need to do to enable uploading files to the Linux computer's backups directory from Windows 11? EDIT: Showing the filesystem of NTFS2TB is NTFS EDIT 2: The vsftpd.log file entry for an attempt to upload is as follows: Sat Apr 26 16:33:42 2025 [pid 6734] CONNECT: Client "::ffff:192.168.40.161" Sat Apr 26 16:33:42 2025 [pid 6733] [todd] OK LOGIN: Client "::ffff:192.168.40.161" Sat Apr 26 16:33:42 2025 [pid 6736] [todd] FAIL DELETE: Client "::ffff:192.168.40.161", "/media/todd/NTFS_PARTITION_2TB/backups/DumpStack.log" EDIT 3: I converted the drive from NTFS to EXT4 and it works now! Thanks everyone.

I have some users in the "sambashare" group and some in the "sambashareAdmin" group. Only users from the "sambashareAdmin" group are alowed to change/create stuff. All files should belong to haegarthehorrible:sambashare. No matter if I create them on the server or if I move/copy them to the server. The problem is that all files get execute permissions on the group (670/-rw-rwx---) and not 660/-rw-rw---- if the Windows workstation user (paradise) does it. I tried "obey pam restrictions" with yes and no in samba what makes no difference. I also tried "create mask" and "directory mask" or "force create mode and "force directory mode" or both together. I tried chmod g+s and g+s,u+s. I tried complicated stuff like: ~$ sudo chmod -R a-x,u=rX,g=rX,u+w,g+w /mnt/pool/Share/Backup ~$ sudo chmod -R a-x,u=rwX,g=rwX /mnt/pool/Share/Backup And also funny ist that if I use "rwX" instead of "rw" (chmod or setfacl) I get execute on the owner permissions. I thought X does only set it on directories? So here is what now looks really complicated and still does not work. Remember this are all directories that already have files/directories in it. ~$ sudo nano /etc/samba/smb.conf [global] server string = Harvester server role = standalone server server min protocol = SMB2 workgroup = WORKGROUP interfaces = lo enp0s31f6 bind interfaces only = yes logging = file log file = /var/log/samba/log.%m max log size = 1000 load printers = no show add printer wizard = no disable netbios = yes dns proxy = no deadtime = 30 smb ports = 445 smb encrypt = off security = user obey pam restrictions = yes panic action = /usr/share/samba/panic-action %d use sendfile = yes directory mask = 2750 create mask = 0640 access based share enum = yes map to guest = bad user guest account = shareguest [Backup] path = /mnt/pool/Share/Backup guest ok = no browseable = no create mask = 0660 directory mask = 2770 force group = sambashare force user = haegarthehorrible write list = @sambashareAdmin valid users = haegarthehorrible paradise inherit acls = Yes Set Permissions: ~$ sudo chown -R haegarthehorrible:sambashare /mnt/pool/Share/Backup ~$ sudo setfacl -R -b -k -n /mnt/pool/Share/Backup # Remove ACL ~$ sudo chmod -R g+s,u+s /mnt/pool/Share/Backup ~$ sudo chmod 0770 /mnt/pool/Share/Backup ~$ sudo find /mnt/pool/Share/Backup -type f -exec chmod 660 {} \; ~$ sudo find /mnt/pool/Share/Backup -type d -exec chmod 2770 {} \; ~$ sudo setfacl -R -d -m u::rw,g::rw,u:haegarthehorrible:rw,g:sambashareAdmin:rw /mnt/pool/Share/Backup # ACL for new items ~$ sudo setfacl -R -m u:haegarthehorrible:rw,g:sambashareAdmin:rw /mnt/pool/Share/Backup # ACL for old/existing items sambashareAdmin Members: ~$ members sambashareAdmin haegarthehorrible paradise sambashare Members: ~$ members sambashare shareguest watcher Share Root Folder Permissions: ~$ ls -ld /mnt/pool/Share drwxr-xr-x 7 root root 4096 Aug 7 2023 /mnt/pool/Share ~$ stat /mnt/pool/Share Access: (0755/drwxr-xr-x) Uid: (0/root) Gid: (0/root) ~$ getfacl /mnt/pool/Share # file: mnt/pool/Share # owner: root # group: root user::rwx group::r-x other::r-x Share Permissions: ~$ ls -ld /mnt/pool/Share/Backup drwsrws---+ 5 haegarthehorrible sambashare 4096 Apr 25 2022 /mnt/pool/Share/Backup ~$ stat /mnt/pool/Share/Backup Access: (6770/drwsrws---) Uid: (1000/haegarthehorrible) Gid: (996/sambashare) ~$ getfacl /mnt/pool/Share/Backup # file: mnt/pool/Share/Backup # owner: haegarthehorrible # group: sambashare # flags: ss- user::rwx group::rwx other::--- default:user::rw- default:user:haegarthehorrible:rw- default:group::rw- default:group:sambashareAdmin:rw- default:mask::rw- default:other::--- File Permissions: ~$ ls -l /mnt/pool/Share/Backup/Test.txt -rw-rwx---+ 1 haegarthehorrible sambashare 0 Feb 11 07:18 /mnt/pool/Share/Backup/Test.txt ~$ stat /mnt/pool/Share/Backup/Test.txt Access: (0670/-rw-rwx---) Uid: (1000/haegarthehorrible) Gid: (996/sambashare) ~$ getfacl /mnt/pool/Share/Backup/Test.txt # file: mnt/pool/Share/Backup/Test.txt # owner: haegarthehorrible # group: sambashare user::rw- user:haegarthehorrible:rw- group::rw- group:sambashare:rw- group:sambashareAdmin:rw- mask::rwx other::---

I have set a face for the SSL folder in the Rocky Linux distro. The folder has default rx for my custom user. But when new SSL & key files are created. Certificate files have proper rights, but the key file does not. So I have a problem accessing the key file. This is the result of getfacl for the folder where the SSL & key are stored. getfacl /usr/local/directadmin/data/users/xyz/domains/ # file: usr/local/directadmin/data/users/xyz/domains/ # owner: diradmin # group: diradmin user::rwx user:myuser:r-x group::--x mask::r-x other::--x default:user::rwx default:user:myuser:r-x default:group::--x default:mask::r-x default:other::--x This is the result for the newly created .key file inside that folder. getfacl /usr/local/directadmin/data/users/xyz/domains/example.com.key # file: usr/local/directadmin/data/users/xyz/domains/example.com.key # owner: diradmin # group: access user::rw- group::r-- other::---

-l 
drwxr-xr-x+   4 root root 4096 Sep 21 04:00 test     << +
drwxrwxrwt.  10 root root  250 Sep 21 04:03 tmp
drwxr-xr-x.  12 root root  144 Sep 19 03:42 usr      << .
drwxr-xr-x.  20 root root  278 Sep 19 03:52 var
drwxr-xr-x  20 root root  278 Sep 19 03:52 test1     <<

if there is a ACL setting value = " + " if there is no ACL setting value = " . " But last directory test1 have gap. why is there a blank space here and How can I create that blank space?