Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop umask from ruining your group-shared files

🧩 The Challenge

Setting up a shared directory for the team always seems to end in a “Permission Denied” nightmare because someone’s default umask keeps stripping write access from new files. I’ve lost count of how many times I’ve had to manually run chmod -R g+w after a developer pushed a bunch of files that only they could modify.

💡 The Fix

You should use the setgid bit on the parent directory to ensure all new files inherit the group ownership, and then set a default ACL so they also inherit the correct permissions regardless of the user’s umask. It saves you from babysitting directory permissions every time someone saves a new log or script.

chmod g+s /path/to/shared/dir
setfacl -R -d -m g::rwX /path/to/shared/dir
setfacl -R -m g::rwX /path/to/shared/dir

⚙️ Why It Works

Adding the setgid bit forces files created in that directory to belong to the directory’s group, while the default ACL entries act as a template that overrides the system’s restrictive umask defaults. Everything created inside then automatically gets the specific permissions you need for your team.

🚀 Pro-Tip: Run getfacl on a directory whenever you’re debugging “why the hell can’t I write to this” issues; it shows you the truth that standard ls output hides.

Linux Tips & Tricks | © ngelinux.com | 8/8/2026