I have a deployment script (based on capifony) that sets te permissions on specific servers for a Symfony2 installation. It contains the following two commands to do this for several directories:setfacl -R -m u:www-data:rwx -m u:`whoami`:rwX app/cachesetfacl -dR -m u:www-data:rwx -m u:`whoami`:rwX app/cacheThese two commands are on the Symfony2 site as a way to fix the permissions, however, these looked strikingly similar to me. So I had a look at the manpages for setfacl, and from what I could understand, the second command does exactly what the first one does with an additional option (which I don't quite understand). My question is, is my assumption correct? If so, would it have the same effect if I removed the first command?
setfacl: Are these two commands the same?
permissions;acl
The first command will change the permissions of any pre-existing files/directories. The -d in the second command is critical to setting the default permissions going forward for any directories, which in turn will provide a default set of ACLs for any files within these directories.NOTE: That in both instances the commands will run recursively via the -R switch.Regarding the -d switch, from the setfacl man page:   -d, --default       All operations apply to the Default ACL. Regular ACL entries in the        input set are promoted to Default ACL entries. Default ACL  entries       in the input set are discarded. (A warning is issued if that happens).This excerpt also explains it fairly well:There are two types of ACLs: access ACLs and default ACLs. An access ACL is the access control list for a specific file or directory. A default ACL can only be associated with a directory; if a file within the directory does not have an access ACL, it uses the rules of the default ACL for the directory. Default ACLs are optional.Source: 8.2. Setting Access ACLs.ExampleSay I have this directory structure.$ tree.|-- dir1|   |-- dirA|   |   `-- file1|   `-- fileA`-- file12 directories, 3 filesNow let's set the permissions using the first setfacl command in your question:$ setfacl -R -m u:saml:rwx -m u:samtest:rwX .Which results in the following:$ getfacl dir1/ file1# file: dir1# owner: saml# group: samluser::rwxuser:saml:rwxuser:samtest:rwxgroup::rwxmask::rwxother::r-x# file: file1# owner: saml# group: samluser::rw-user:saml:rwxuser:samtest:rwxgroup::rw-mask::rwxother::r--Without the -dR command run here, new directories would not be covered by your ACLs:$ mkdir dir2$ getfacl dir2# file: dir2# owner: saml# group: samluser::rwxgroup::rwxother::r-xBut if we remove this directory and run the setfacl -dR ... command and repeat this operation above:$ rmdir dir2$ setfacl -dR -m u:saml:rwx -m u:samtest:rwX .Now the permissions look quite different:$ getfacl dir1/ file1 # file: dir1/# owner: saml# group: samluser::rwxuser:saml:rwxuser:samtest:rwxgroup::rwxmask::rwxother::r-xdefault:user::rwxdefault:user:saml:rwxdefault:user:samtest:rwxdefault:group::rwxdefault:mask::rwxdefault:other::r-x# file: file1# owner: saml# group: samluser::rw-user:saml:rwxuser:samtest:rwxgroup::rw-mask::rwxother::r--And now our newly created directory will pick up these default permissions:$ mkdir dir2$ getfacl dir2# file: dir2# owner: saml# group: samluser::rwxuser:saml:rwxuser:samtest:rwxgroup::rwxmask::rwxother::r-xdefault:user::rwxdefault:user:saml:rwxdefault:user:samtest:rwxdefault:group::rwxdefault:mask::rwxdefault:other::r-xHaving these permissions in place on dir2 will now enforce these permissions on files within dir2 as well:$ touch dir2/fileA$ getfacl dir2/fileA # file: dir2/fileA# owner: saml# group: samluser::rw-user:saml:rwx           #effective:rw-user:samtest:rwx        #effective:rw-group::rwx          #effective:rw-mask::rw-other::r--