Linux Directory Permissions & ACLs Guide

This reference guide summarizes our technical chat session regarding automated file permissions. You can open and edit this file directly in any text or HTML editor.

1. The Problem & Core Solution

While chmod g+s (SGID) forces child elements to inherit group ownership, it cannot dynamically distinguish between file and folder permissions. To automatically make new folders rwx and new files rw- for a group, we use Default Access Control Lists (ACLs).

The Automation Setup:

# 1. Fix permissions for all PRESENT files and folders recursively
setfacl -R -m g::rwX /path/to/parent_directory

# 2. Fix inheritance for all FUTURE files and folders recursively
setfacl -R -d -m g::rwX /path/to/parent_directory

2. Understanding Flags & Syntax

-d (Default): Creates an inheritance template. It tells Linux that any future item created inside this folder must automatically inherit these rules.
-m (Modify): Modifies the existing ACL profile.
-R (Recursive): Ensures that any subdirectories that already exist receive this configuration template. Without -R, existing subdirectories are skipped.

Why capital `rwX` instead of lowercase `rwx`?

The capital X acts as a conditional execute flag:

Target Type	Resulting Permission	Reasoning
Directories	`rwx`	Required so the group can enter and navigate the folder.
Regular Files	`rw-`	Prevents standard documents (text, images) from dangerously becoming executable files.

3. Interaction with SGID (g+s)

setfacl and chmod g+s do not conflict because they govern entirely different tasks:

SGID (g+s) handles identity / ownership (Who owns the new files).
ACLs (setfacl) handle access control / permissions (What they can do).

Applying a capital X to a folder marked with an uppercase rwS (missing execute) will automatically repair it into a fully functional lowercase rws directory.

4. The Mind Map

A structured mapping of global vs. targeted inheritance configurations:

┌──────────────────────────────────────────────┐ │ LINUX SHARED DIRECTORIES │ └──────────────────────┬───────────────────────┘ │ ┌───────────────────────┴───────────────────────┐ ▼ ▼ ┌─────────────────────────┐ ┌─────────────────────────┐ │ GROUP OWNERSHIP │ │ GROUP PERMISSIONS │ │ (Who owns) │ │ (What they can do) │ └────────────┬────────────┘ └────────────┬────────────┘ │ │ ▼ ▼ ┌─────────────────────────┐ ┌─────────────────────────┐ │ chmod g+s │ │ How to automate it? │ │ (Set Group ID) │ └────────────┬────────────┘ └────────────┬────────────┘ │ │ ┌───────────────┴───────────────┐ ▼ ▼ ▼ ┌─────────────────────────┐ ┌─────────────────────────┐ ┌─────────────────────────┐ │ Inheritance Rule: │ │ GLOBAL APPROACH │ │ PER-DIRECTORY APPROACH │ │ New items automatically│ │ (Old Way) │ │ (Modern Alternative)│ │ belong to the group. │ └────────────┬────────────┘ └────────────┬────────────┘ └─────────────────────────┘ │ │ ▼ ▼ ┌─────────────────────────┐ ┌─────────────────────────┐ │ umask │ │ setfacl │ │ Affects entire user │ │ Targets specific path. │ │ profile everywhere. │ │ Smart 'rwX' logic for │ │ │ │ files vs. directories. │ └─────────────────────────┘ └─────────────────────────┘

Note: The main sections above have been marked with contenteditable="true", meaning you can type edits directly onto the web page when opened in a browser before saving.