Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007 Installation Manual page 307

group:mascots:rwx
mask::r-x
other::---
After executing the chmod command to remove the write permission from the group
class bits, the output of the ls command is sufficient to see that the mask bits must
have changed accordingly: write permission is again limited to the owner of mydir.
The output of the getfacl confirms this. This output includes a comment for all those
entries in which the effective permission bits do not correspond to the original permis-
sions, because they are filtered according to the mask entry. The original permissions
can be restored at any time with chmod g+w mydir.
14.4.3 A Directory with a Default ACL
Directories can have a default ACL, which is a special kind of ACL defining the access
permissions that objects in the directory inherit when they are created. A default ACL
affects both subdirectories and files.
Effects of a Default ACL
There are two ways in which the permissions of a directory's default ACL are passed
to the files and subdirectories:
• A subdirectory inherits the default ACL of the parent directory both as its default
ACL and as an access ACL.
• A file inherits the default ACL as its access ACL.
All system calls that create file system objects use a mode parameter that defines the
access permissions for the newly created file system object. If the parent directory does
not have a default ACL, the permission bits as defined by the umask are subtracted
from the permissions as passed by the mode parameter, with the result being assigned
to the new object. If a default ACL exists for the parent directory, the permission bits
assigned to the new object correspond to the overlapping portion of the permissions of
the mode parameter and those that are defined in the default ACL. The umask is dis-
regarded in this case.
# effective: r-x
Access Control Lists in Linux 289