Re: [PLUG] setfacl confusion

So I ended up going to Red Hat's support site, and I was going to open a ticket, ask somebody there what I was doing wrong. And their troubleshooting AI solved it, before I could even open the case. That's a useful AI ...

It told me:

The issue you're encountering is due to the way default ACLs work on directories. When you set a default ACL with setfacl -R -d -m g:FileCollector:rwx uploads, it only applies to new files and subdirectories created *after* the ACL is set. Existing files and directories retain their original permissions, which is why members of the FileCollector group still get "Permission denied" when trying to delete files.

Solution
To grant the FileCollector group the ability to delete existing files in the uploads directory, you need to:

Set the default ACL (which you've already done):

sudo setfacl -R -d -m g:FileCollector:rwx uploads

Apply the ACL to existing files and directories:

sudo setfacl -R -m g:FileCollector:rwx uploads

This command applies the rwx permissions to the FileCollector group for all existing files and directories within uploads.

Verification
After applying the ACLs, verify the permissions with:

getfacl uploads
You should see entries similar to:

# file: uploads
# owner: <owner>
# group: <group>
user::rwx
group::r-x
group:FileCollector:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:FileCollector:rwx
default:mask::rwx
default:other::r-x

And it does work! And the directory perms are set:

FileCollector@PHASFTP001:/ftp-area/grainger$ getfacl uploads
# file: uploads
# owner: grainger
# group: sftpusers
user::rwx
group::rwx
group:FileCollector:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:FileCollector:rwx
default:mask::rwx
default:other::r-x

Does this qualify as "vibe coding"? I dunno, but it solved our issue, so I could more on to other things. So yay AI (for today).

On Wed, Sep 23, 2026 at 10:19 AM Mike Leone <turgon@mike-leone.com> wrote:
>
> More info.
>
> I tried adding the "FileCollector" group as a secondary group to my user. But I'm still having permissions issues.
>
> FileCollector@PHASFTP001:/ftp-area/staples/uploads$ ls -la
> total 4
> drwxrwxr-x+ 2 staples sftpusers 23 Sep 23 10:04 .
> drwxr-xr-x. 3 root root 77 Sep 22 16:51 ..
> -rw-rw-r--+ 1 staples sftpusers 837 Sep 23 10:04 Notes.TXT
> FileCollector@PHASFTP001:/ftp-area/staples/uploads$ rm Notes.TXT
> rm: cannot remove 'Notes.TXT': Permission denied
> FileCollector@PHASFTP001:/ftp-area/staples/uploads$ sudo getfacl Notes.TXT
> [sudo] password for FileCollector:
> # file: Notes.TXT
> # owner: staples
> # group: sftpusers
> user::rw-
> group::r-x #effective:r--
> group:FileCollector:rwx #effective:rw-
> mask::rw-
> other::r--
>
> FileCollector@PHASFTP001:/ftp-area/staples/uploads$ groups
> FileCollector wheel
> FileCollector@PHASFTP001:/ftp-area/staples/uploads$
>
> I can't seem to figure setfacl out. it looks (to me) like the file "Notes.TXT" allows a member of the group "FileCollector" to have rwx rights, which means a member of the group "FileCollector" should be able to delete said file.
>
> Obviously, not the case. So I don't know how I can allow this group "FleCollector" to have rights to be able to delete files uploaded by a member of the "sftpusers" group.
>
> Anybody? I seem to just be beating my head against a wall here.
>
>
>
> On Tue, Sep 22, 2026 at 5:04 PM Mike Leone <turgon@mike-leone.com> wrote:
>>
>> So what am I doing wrong?
>>
>> Every users home folder has a sub-folder called "uploads". I want to add the group "FileCollector" to the ACL of this group, so that a user in the group "FileCollector" will be ble to remove files in the uploads folder (and only that folder).
>>
>> So I did this:
>>
>> ftp-admin@PHASFTP001:/ftp-area/staples$ sudo setfacl -R -d -m g:FileCollector:rwx uploads
>>
>> FileCollector@PHASFTP001:/ftp-area/staples$ getfacl uploads/
>> # file: uploads/
>> # owner: staples
>> # group: sftpusers
>> user::rwx
>> group::r-x
>> other::r-x
>> default:user::rwx
>> default:group::r-x
>> default:group:FileCollector:rwx
>> default:mask::rwx
>> default:other::r-x
>>
>> And then I can't delete ...
>>
>> FileCollector@PHASFTP001:/ftp-area/staples/uploads$ ls -la
>> total 0
>> drwxr-xr-x+ 2 staples sftpusers 28 Sep 22 16:52 .
>> drwxr-xr-x. 3 root root 77 Sep 22 16:51 ..
>> -rw-r--r--. 1 staples sftpusers 0 Sep 22 16:52 touch-THIS.txt
>>
>> FileCollector@PHASFTP001:/ftp-area/staples/uploads$ sudo getfacl touch-THIS.txt
>> # file: touch-THIS.txt
>> # owner: staples
>> # group: sftpusers
>> user::rw-
>> group::r--
>> other::r--
>>
>>
>>
>> What did I miss?
>> --
>>
>> Mike. Leone, <mailto:turgon@mike-leone.com>
>>
>> PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
>> Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>
>
>
>
> --
>
> Mike. Leone, <mailto:turgon@mike-leone.com>
>
> PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
> Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>
>

--

Mike. Leone, <mailto:turgon@mike-leone.com>

PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>