In this lesson, you will learn how to use Default ACLs to ensure that files and subdirectories automatically inherit specific access permissions from their parent directory.
The Problem with Standard Inheritance
In a standard UGO model, when you create a new file, it inherits the primary group of the directory, but its specific read/write/execute permissions are dictated by your process umask. If you have a shared project directory where you want every new file to be readable by a specific "project-team" group, you would normally have to manually run chmod or setfacl on every single file you create. Default ACLs solve this by acting as a "permission template" for future child objects.
Configuring Default ACLs
A Default ACL is attached to a directory, not a file. Once set, any new file or subdirectory created inside that directory will automatically copy the Default ACL settings as its own Access ACL.
To set a default ACL for a group (e.g., developers) on a folder named project_data, use the -d (default) flag:
# Give 'developers' group read and write access to future files
setfacl -d -m g:developers:rw project_data/
Once this is set, verify it by running getfacl project_data/. You will see two sections: ACL (for the directory itself) and Default ACL (the blueprint for children).
Why This Matters
When a user creates a file inside project_data, the kernel checks the parent's Default ACL. If the Default ACL specifies that the developers group should have rw access, that entry is automatically applied to the new file. This creates a "persistent" security policy that remains enforced regardless of the individual user's umask settings. It is the most effective way to manage collaborative folders where multiple users frequently drop new files that must remain accessible to the entire team.
Note that Default ACLs only apply to items created after the default is set; existing files remain unchanged. If you need to fix existing files, you must use the recursive flag (-R), though the default ACL will handle all future work for you.
Key Takeaway: Default ACLs provide an automated inheritance mechanism that enforces consistent access control policies across dynamic project structures without requiring manual permission adjustments.