We have a Linux box running Ubuntu 10.04. It's primary function is a web server and it is configured with (I think) a conventional LAMP stack.
Developers have access to a common directory "dev" which contains a sub directory which serves as the web root. All developers have individual SSH access.
When developers create files in the "dev" directory tree, or pull files into "dev" from a repository we want the file permissions to be rwxrwxr-x. Instead newly created files have permissions of rw-r--r--. By modifying ACLs and setting group and user id on "dev" with sticky bits etc. I have managed to get newly created files with permissions of rw-rw-r--.
I assume the problem is down to the umask configuration which is currently set using the global value of 022 in /etc/profile. I don't want to change the umask globally or for each developer to allow more relaxed default permissions.
I can't see a way of achieving what we want with ACLs and umask unless I am missing something. Surely this is a fairly common requirement for web developers working on shared projects.
Is there a preferred or recommended approach?
Initially I set the gid on "dev" as follows.
chmod g+s dev ls -l drwxrwsr-x 8 755 admin 4096 Jan 19 13:24 dev The default ACL on "dev" is as follows.
getfacl dev # file: dev # owner: 755 # group: admin # flags: -s- user::rwx group::rwx other::r-x I applied an ACL for the "admin" group (to which developers belong).
setfacl -Rm d:g:admin:rwX getfacl dev # file: dev # owner: 755 # group: admin # flags: -s- user::rwx group::rwx other::r-x default:user::rwx default:group::rwx default:group:admin:rwx default:mask::rwx default:other::r-x I create a file and check file permissions.
touch dev/foo ls -l dev -rw-rw-r--+ 1 duncmc admin 0 Jan 19 16:03 foo This time I add an ACL for my user "duncmc"
setfacl -Rm u:duncmc:rwX dev getfacl dev # file: dev # owner: 755 # group: admin # flags: -s- user::rwx user:duncmc:rwx group::rwx mask::rwx other::r-x default:user::rwx default:group::rwx default:group:admin:rwx default:mask::rwx default:other::r-x I create a new file and check permissions.
touch dev/bar ls -l dev -rw-rw-r--+ 1 duncmc admin 0 Jan 19 16:07 bar -rw-rwxr--+ 1 duncmc admin 0 Jan 19 16:03 foo Adding an ACL for my user appears to have changed the group permission (was rw- now rwx) on the existing file "foo". The newly created file has inherited different permissions. This doesn't make sense to me and suggests there is something fundamental about the way this works that I don't understand.
