Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 153 / 450

group:mascots:rwx # effective: r-x
mask::r-x
other::---
After executing the
chmod
command to remove the write permission from the group
class bits, the output of the
ls
command is sufficient to see that the mask bits must
have changed accordingly: write permission is again limited to the owner of
mydir
.
The output of the
getfacl
confirms this. This output includes a comment for all those
entries in which the effective permission bits do not correspond to the original permis-
sions, because they are filtered according to the mask entry. The original permissions
can be restored at any time with
chmod g+w mydir
.
10.4.3 A Directory with a Default ACL
Directories can have a default ACL, which is a special kind of ACL defining the access
permissions that objects in the directory inherit when they are created. A default ACL
affects both subdirectories and files.
Effects of a Default ACL
There are two ways in which the permissions of a directory's default ACL are passed
to the files and subdirectories:
• A subdirectory inherits the default ACL of the parent directory both as its default
ACL and as an access ACL.
• A file inherits the default ACL as its access ACL.
All system calls that create file system objects use a
mode
parameter that defines the
access permissions for the newly created file system object. If the parent directory does
not have a default ACL, the permission bits as defined by the
umask
are subtracted
from the permissions as passed by the
mode
parameter, with the result being assigned
to the new object. If a default ACL exists for the parent directory, the permission bits
assigned to the new object correspond to the overlapping portion of the permissions of
the
mode
parameter and those that are defined in the default ACL. The
umask
is dis-
regarded in this case.
Access Control Lists in Linux 139