My aim is to allow read access to folder /var/www/mysite/ only for users in group www-data using a default ACL.This works for a regular ACL, but not for a default ACL. Why?This is how I did it:I am logged on as user www-data who is in group www-data. I am in directory /var/www.I created a directory mysite and gave it the permission 0. Then I added ACL permissions so that anyone in group www-data has read-access to directory mysite/.$ mkdir mysite$ chmod 0 mysite$ setfacl -m g:www-data:r-x mysite$ ls -lad---------+  2 root root 4096 Sep  6 11:16 mysite$ getfacl mysite/# file: mysite/# owner: root# group: rootuser::---group::---group:www-data:r-xmask::r-xother::---At this point user www-data has access to the folder. However, if I instead add a default ACL, access is denied!$ setfacl -m d:g:www-data:r-x mysite # <---- NOTE the default acl rule.$ ls -lad---------+  2 root root 4096 Sep  6 11:16 mysite$ getfacl mysite/# file: mysite/# owner: root# group: rootuser::---group::---other::---default:user::---default:group::---default:group:www-data:r-xdefault:mask::r-xdefault:other::---
Why don't I have read access to files with modified ACL?
acl
The default ACL is the ACL that is applied to newly created files in that directory. It is also copied as the default ACL for subdirectories created under that directory, so unless you do something to override it it applied recursively.The default ACL has no effect on the directory itself, or on any files that exist when you change the default ACL.So in your situation you need to both set the ACL on the directory (for the directory itself) and set the default ACL (for files that you will create in the directory).