Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop thinking chmod is enough for fine-grained access

🧩 The Challenge

Dealing with a shared web directory where the group needs read/write access but you don’t want to chmod 777 everything into oblivion is a nightmare. I’ve spent way too many nights fixing broken permissions because some developer dragged a file into the repo that killed the web server’s access.

💡 The Fix

Use ACLs instead of fighting the standard Unix bitmask, because they let you set default permissions that actually stick to new files. It’s the only way to keep a shared directory sane without constantly running recursive chown or chmod commands.

setfacl -R -m d:g:developers:rwX /var/www/shared
setfacl -R -m g:developers:rwX /var/www/shared

⚙️ Why It Works

Setting the default ACL ensures that any new file created in that directory automatically inherits the correct group access, meaning you stop chasing ghost permission errors. It basically forces the filesystem to behave how you expect it to rather than how the legacy mode wants it to.

🚀 Pro-Tip: Always verify your new setup with getfacl, because the standard ls output will hide those sneaky plus signs right in front of your face.

Linux Tips & Tricks | © ngelinux.com | 10/20/2026