Default ACLs on a directory are inherited by files and subdirectories created under that directory.It seems a common requirement that by default subdirectories should be executable (i.e. cd-able) but files should not.How can I set separate default (i.e. to be inherited) ACLs for subdirectories and (child-) files, or otherwise achieve this effect?Addendum:Raspberry Pi Model B, Raspbian, get/setfacl 2.2.51cat /proc/versionLinux version 3.6.11+ (dc4@dc4-arm-01) (gcc version 4.7.2 20120731 (prerelease) (crosstool-NG linaro-1.13.1+bzr2458 - Linaro GCC 2012.08) ) #474 PREEMPT Thu Jun 13 17:14:42 BST 2013
ACL defaults: files vs directories
linux;raspberry pi;acl
There is only one default, but when a file inherits an ACL, it gets modified by a mask which is set from the mode which programs set when they open a file for writing. (The mode is actually modified by the umask - the bits from the umask are removed, so mode 666 plus umask 002 becomes 664.) If the mode is 664 for example, the mask will be rw- which causes the x flag to be masked out for all named acls and for the group, so that effectively there is no execute permission. The mask is created from the group bits of the mode or the group bits of a chmod if that is used.So if you create a normal file, it will have x set in the ACL but it will be masked. Directories are by default created with mode 755 or 775 (depending on umask), so that the mask will be rwx or r-x. So the x-flag in the ACL stays effective.I was confused before with the capital X. That only applies when you set ACLs for multiple files at once. Then you can set the permission to X which will cause directories to have x and files will not. 