Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop setting 777 permissions when you just need a group to write

🧩 The Challenge

Dealing with a shared data directory where web apps and users both need access usually leads to lazy chmod 777 hacks that make me shudder. I’ve wasted way too many hours cleaning up permissions because someone decided that making a file world-writable was the only way to get a service to talk to a folder.

💡 The Fix

Use POSIX ACLs to grant specific access to both the user and the group without breaking standard file modes. It’s the clean way to handle multi-user access without throwing security out the window.

setfacl -m u:www-data:rwx /var/www/shared_folder
setfacl -d -m u:www-data:rwx /var/www/shared_folder

⚙️ Why It Works

By applying the default ACL flag with the -d switch, every new file created in that directory automatically inherits the permissions you defined. It effectively forces a sane permission inheritance model that standard unix bits simply can’t touch.

🚀 Pro-Tip: Run getfacl on the directory after you’re done to see exactly who has access, because ls -l hides those extra plus signs right in front of your face.

Linux Tips & Tricks | © ngelinux.com | 10/22/2026