In this lesson, you will learn how to identify and resolve instances where nested directory permissions conflict with inherited default ACLs, causing unexpected access denials.
When you set a Default ACL on a parent directory, new files and subdirectories automatically inherit those permissions. However, problems arise when you manually modify a subdirectory’s ACL after it has already inherited its initial set of rules. This creates a "stale" inheritance state where the parent’s intent and the child’s actual permissions diverge.
The Anatomy of the Conflict
Imagine you have a project folder /data/project with a default ACL that grants the developers group read/write access. You then create a folder /data/project/logs. The logs directory inherits the developers:rw rule.
Later, you decide the logs folder should be restricted, so you run setfacl -m g:developers:r /data/project/logs. If a user belonging to developers attempts to write to a new file created inside /data/project/logs, they might be denied access despite the parent directory's settings. This happens because the logs directory’s own ACL (the "access" entry) acts as a local override that prevents further propagation of the broader parent permissions.
Debugging the Mismatch
To debug this, you must distinguish between the "access" ACL and the "default" ACL. Use the getfacl command on both the parent and the child:
# View current access and default ACLs for the parent
getfacl /data/project
# View the actual permissions causing the conflict in the child
getfacl /data/project/logs
If you see default:group:developers:rw- on the parent, but group:developers:r-- on the logs folder, the child has drifted from the parent’s policy.
To fix this, you must explicitly reset the child’s ACLs to match your desired inheritance or clear the existing specific entries that are overriding the defaults. If you want the child to strictly follow the parent again, you can use the -b (remove all) or -k (remove default) flags and re-apply the intended policy to force synchronization.
Key Takeaway: ACL inheritance is a snapshot taken at file creation; if you modify a subdirectory’s ACL manually, it breaks the link to the parent's default policy, requiring a manual audit to resynchronize.