Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop playing permission roulette with shared directories

🧩 The Challenge

You’ve got a shared directory where three different users, from different primary groups, all need to drop files in, read each other’s work, and generally just *cooperate*. But you can’t just `chmod 777` it, that’s asking for trouble. And constantly adding new users to some auxiliary group and messing with umask on creation? Nobody’s got time for that. It’s a permission nightmare that eats way too much of your day.

💡 The Fix

Forget about bending `chmod` to your will for this. There’s a better way to give specific users fine-grained access without blowing open security for everyone. You can just grant explicit permissions to individuals and groups, directly on the directory, and even make new files inherit them. It fixes the problem quickly and reliably.

# First, enable ACL support on the filesystem if it's not already.
# (Often default, but check 'mount' output or fstab for 'acl' option.
# If missing, you might need to remount: mount -o remount,acl /path/to/filesystem)

# Create the shared directory
mkdir /srv/data/project_phoenix
chmod 770 /srv/data/project_phoenix # Start with sane permissions

# Grant specific users read, write, execute access
setfacl -m u:alice:rwx,u:bob:rwx /srv/data/project_phoenix

# Grant a specific group read, write, execute access (if needed)
# setfacl -m g:devteam:rwx /srv/data/project_phoenix

# Make new files/directories inherit these ACLs by default
setfacl -m d:u:alice:rwx,d:u:bob:rwx /srv/data/project_phoenix
# setfacl -m d:g:devteam:rwx /srv/data/project_phoenix # If using group inheritance

# Check the ACLs
getfacl /srv/data/project_phoenix

⚙️ Why It Works

File ACLs extend the traditional UNIX permissions by letting you define rules for specific users or groups beyond the owner, owning group, and others. The `setfacl -m` command modifies (m) the ACLs, and the `d:` prefix tells it to set *default* ACLs, which newly created files and subdirectories will automatically inherit. This means you set it once, and it just works.

🚀 Pro-Tip: When `ls -l` shows a `+` next to the permissions, that’s your clue ACLs are in play. Use `getfacl` to actually see them.

Linux Tips & Tricks | © ngelinux.com | 10/16/2026