Setting Default File Permissions - Revision history

Jrwrigh: Add blurb on directories and executable permissions

2021-03-11T16:32:59Z

Add blurb on directories and executable permissions

Jrwrigh: /* Newly Created File Only Doesn't Fully Inherit Default ACL Rules */: Fix grammar

2021-02-13T16:32:06Z

‎Newly Created File Only Doesn't Fully Inherit Default ACL Rules: : Fix grammar

Jrwrigh at 15:31, 5 September 2020

2020-09-05T15:31:31Z

Jrwrigh: /* NAS */

2020-07-10T16:36:33Z

‎NAS

Jrwrigh at 16:27, 10 July 2020

2020-07-10T16:27:23Z

Jrwrigh: /* Newly Created File Only Doesn't Fully Inherit Default ACL Rules */

2020-07-08T13:53:41Z

‎Newly Created File Only Doesn't Fully Inherit Default ACL Rules

Jrwrigh: /* Newly Created File Only Doesn't Fully Inherit Default ACL Rules */

2020-07-08T13:53:12Z

‎Newly Created File Only Doesn't Fully Inherit Default ACL Rules

Jrwrigh: /* Newly Created File Only Doesn't Fully Inherit Default ACL Rules */

2020-07-08T13:51:58Z

‎Newly Created File Only Doesn't Fully Inherit Default ACL Rules

Jrwrigh at 04:04, 7 July 2020

2020-07-07T04:04:33Z

Jrwrigh at 03:34, 7 July 2020

2020-07-07T03:34:07Z

Show changes

@@ Line 109: / Line 109: @@
   mask::r-x
   other::---
 == System Specific Instructions ==

@@ Line 77: / Line 77: @@
   other::---
-We see that the file did inherit the <code>default:</code> ACL entries for <code>group::</code>, <code>group:a1983:</code>, and <code>other::</code>. However, the <code>mask::</code> and <code>user::</code> are different than its corresponding <code>default:</code> value. Also, However, there is an <code>#effective:r--</code> message next to the <code>group::</code> and <code>group:a1983:</code> entries. This message is showing that the permissions for <code>group::</code> and <code>group:a1983:</code> are being overridden by the <code>mask::r--</code> entry.
+We see that the file did inherit the <code>default:</code> ACL entries for <code>group::</code>, <code>group:a1983:</code>, and <code>other::</code>. However, the <code>mask::</code> and <code>user::</code> are different than its corresponding <code>default:</code> value, and there is an <code>#effective:r--</code> message next to the <code>group::</code> and <code>group:a1983:</code> entries. The latter message is showing that the permissions for <code>group::</code> and <code>group:a1983:</code> are being overridden by the <code>mask::r--</code> entry.
 This is because <code>touch</code> uses a "mode" parameter of <code>666</code> when creating the new file object (<code>6</code> translates to <code>rw-</code>, see [[File_Permissions_Basics_and_ACL#Permissions as Octal Numbers| Permissions as Octal Numbers]]). Since the <code>ACL_MASK</code> entry is used to limit the <code>group:</code> entries such that the effective permissions do not exceed the "mode" parameter. Since the "mode" parameter does not feature execute permissions for <code>ACL_GROUP_OBJ</code>, the <code>mask:</code> entry is set to remove the effective execute permission from the <code>group:</code> entries.

@@ Line 1: / Line 1: @@
-This page will review how to set default file permissions for a directory. This is often used when working in HPC "scratch" directories where members of the same research group (like us) want to give each other some default file permissions on every file created in those directories, regardless of who created them.
+This page will review how to set default file permissions for a directory using [[File_Permissions_Basics_and_ACL|Access Control Lists (ACL)]]. This is often used when working in HPC "scratch" directories where members of the same research group (like us) want to give each other some default file permissions on every file created in those directories, regardless of who created them.
 The basis of this is to edit the ACL entries of the directories that we want default file permissions to apply to. To see more information on how ACL and file permissions work, see [[File_Permissions_Basics_and_ACL|File Permissions Basics and ACL]].
 == Setting ACL Rules ==

@@ Line 115: / Line 115: @@
 === NAS ===
-To grant the group <code>r-x</code> permissions to your <code>/nobackup/</code> directory:
+Currently, the group ID of PHASTA members is <code>a1983</code>. To grant the group <code>r-x</code> permissions to your <code>/nobackup/</code> directory:
 * Run <code>setfacl -Rd -m g:a1983:rx /nobackup/$USER</code>

← Older revision		Revision as of 16:27, 10 July 2020
Line 110:		Line 110:
	mask::r-x		mask::r-x
	other::---		other::---
		+
		+	== System Specific Instructions ==
		+
		+	=== NAS ===
		+
		+	To grant the group <code>r-x</code> permissions to your <code>/nobackup/</code> directory:
		+
		+	* Run <code>setfacl -Rd -m g:a1983:rx /nobackup/$USER</code>
		+	** This will make all new files inherit those permissions
		+	* Run <code>setfacl -R -m g:a1983:rx /nobackup/$USER</code>
		+	** This will give all current files group permissions
		+
		+	'''Note:''' The [[Setting_Default_File_Permissions#Newly Created File Only Doesn't Fully Inherit Default ACL Rules\|issue with files not inheriting executable permissions]] is present here. This must be fixed on a file-by-file basis unfortunately using either <code>setfacl -m m:rx testfile</code> or (if the file group is the group you want to give permissions to) <code>chmod g+x testfile</code>.

@@ Line 65: / Line 65: @@
 : Note that all the <code>default:</code> entries have execute permissions except <code>other</code>
-I'll create new file in that directory using `touch`:
+I'll create new file in that directory using <code>touch</code>:
   $ touch testfile

@@ Line 44: / Line 44: @@
 This is probably most common with files that don't inherit the executable permission from the default ACL. In [[File_Permissions_Basics_and_ACL#How are new file permissions set?| How are new file permissions set?]], it is explained that the <code>ACL_MASK</code> (among others) will be set such that the resulting ACL permissions do not exceed the permissions set by the "mode" parameter (which is used by the program creating the file). Often, this "mode" parameter does not include execute permissions.
-This is normal behavior and can always be overridden with `chmod`.
+This is normal behavior and can be overridden with manually running <code>setfacl</code> (or <code>chmod</code> if only the three basic permissions need to be changed).
 '''Example:'''

@@ Line 42: / Line 42: @@
 tl;dr ACL Default entries are not the only thing that controls the permissions of new files. See [[File_Permissions_Basics_and_ACL#Custom Permissions| Custom Permissions]] for deeper explanation.
-This is probably most common with files that don't inherit the executable permission from the default ACL. In [[File_Permissions_Basics_and_ACL#How are new file permissions set?| How are new file permissions set?]], it is explained that the <code>ACL_MASK</code> (among others) will be set such that the resulting ACL permissions do not exceed the permissions set by the "mode" parameter (which is used by the program creating the file). Often, this "mode" parameter does not include execute permissions (with the primary exception being compilers, which will set binaries with execute permissions).
+This is probably most common with files that don't inherit the executable permission from the default ACL. In [[File_Permissions_Basics_and_ACL#How are new file permissions set?| How are new file permissions set?]], it is explained that the <code>ACL_MASK</code> (among others) will be set such that the resulting ACL permissions do not exceed the permissions set by the "mode" parameter (which is used by the program creating the file). Often, this "mode" parameter does not include execute permissions.
 This is normal behavior and can always be overridden with `chmod`.