Setup ACL for folders

Before setting up ACL (access control list) for folders, we must enable in mounting, so in /etc/fstab we have something like:

/dev/VG01/LV01 /data ext3 defaults,acl 1 2

We use the --set switch here. It overwrites existing ACL.

Allow the owner and members of somegroup to have read/write access to a folder:

# set default ACL
setfacl -d --set u::rwx,g::---,g:somegroup:rwx,o::--- /u/samba/public

# set current ACL
setfacl --set u::rwx,g::---,g:somegroup:rwx,o::--- /u/samba/public


# Or, in one line:
setfacl --set d:u::rwx,g::---,d:g:somegroup:rwx,d:o::---,u::rwx,g::---,g:somegroup:rwx,o::--- /u/samba/public

We use the -m switch here. It modifies existing ACL without overwriting.

Grant read write access to apache on folder /u/websites:

# modify defaults
setfacl -R -d -m u:apache:rwx /u/websites

# modify current files
setfacl -R -m u:apache:rwx /u/websites

Revoke all access rights from apache on folder /u/websites:

# revoke from defaults
setfacl -R -d -x u:apache /u/websites

# revoke from current files
setfacl -R -x u:apache /u/websites