ACL confusion

UNIX for Advanced & Expert Users
1

All,

I am trying to clear ACL's completely from all files and folders in a directory. I can get the directories as cleared as:

# owner: root
# group: root
user::rwx
group::r-x
other::rwx
default:user::rwx
default:group::r-x
default:other::r-x

What ever I do I can't remove the defaults from the directories. I have traversed back up the directory tree to confirm that there are no visible (no + at the end of any directories) ACL's present, but still the same behavior. I run:

# setfacl -k <dir>

and still receive:

# owner: root
# group: root
user::rwx
group::r-x
other::rwx
default:user::rwx
default:group::r-x
default:other::r-x

Can anyone shed some light on what using the '-k' flag does nothing, or provide some guidance as to possibly a '-x' flag string that would remove the default settings?

Nothing I have tried has worked.

Thank in advance,

HB

2

Can you use setfacl -b <dir> option to clear all ACL entries ?

This will leave only regular permissions.

Hope that helps
Regards
Peasant.

1 Like
3

@Peasant, thank you for the response.

Unfortunately using the '-b' flag does nothing at all. I would expect to be able to do:

# setfacl -b <dir>
# setfacl -k <dir>

And all ACL's would be removed back to regular permissions, but this isn't the case. Neither command removes ACL's. As I mentioned, I thought it might be that they were just getting inherited from up the directory tree but there are no ACL's up the tree.

Any thoughts on what might be causing the '-b' and '-k' to do nothing to the ACL's? Possibly an issue with a mask?

Thanks,

HB

4

setfacl -dx [acl lists ] delete files/directories ACLs for the default (-d is default) (-x removes -X also removes)

Try reading the ACL man page first, then read the setfacl page -- links below. Based on your comments I think you may have gotten some wrong information. Make sure you understand what you are doing, create a dummy directory with some files - touch creates empty files. Play with your dummy directory and files FIRST before you trash something like the /usr directory tree irrevocably - and lose your system.

setfacl(1): set file access control lists - Linux man page
acl(5): Access Control Lists - Linux man page

1 Like
5

Thanks for the reply. No, this is not a system directory. It is 25TB of unstructured data.

I was unable to come up with a solution prior to needing it back online so I remounted the directory without the 'acl' option to avoid the permission confusion. I will need to address this in the next couple weeks and will update on the progress..

HB