What relationships tie ACL mask and standard group permission on a file

aclfilespermissions

At first I create a file and check it's standard permissions and ACL entries:

$ touch file; ls -l file; getfacl file
-rw-r--r-- 1 user user 0 Jul 30 16:26 file
# file: file
# owner: user
# group: user
user::rw-
group::r--
other::r--

Then I set the ACL mask on the file and again check it's standard permissions and ACL entries:

$ setfacl -m mask:rwx file
$ ls -l file; getfacl file
-rw-rwxr--+ 1 user user 0 Jul 30 16:26 file
# file: file
# owner: user
# group: user
user::rw-
group::r--
mask::rwx
other::r--

Note that along with ACL mask standard group permission on the file also changed.

  1. What connection does exist between ACL mask and standard group permission?
  2. What is the reason for coupling ACL mask and file group permissions? What logic does lay behind it?

The distributions in question are Debian Linux 7.6 and CentOS 7

EDIT

At this point I just wanted to share some findings of mine I came up with while researching the relations between standard file group permissions and ACL mask. Here are the empirical observations I found:

  1. The ACL mask can be changed:

    1. by directly setting it with setfacl -m m:<perms> command;
    2. by changing file group permissions with chmod command (if ACL mask is already present; it may not be present because it is optional if there are no named user or group ACL permissions on the file);
    3. by adding either named user or group ACL entry (mask will be automatically recalculated).

  2. The mask will enforce maximum access rights (if there are ACL entries with permissions present that exceed the ACL mask permissions) only if the mask is set directly by setfacl or by modification of file group permission with chmod (not auto-calculated). Any changes to ACL entries will trigger the ACL mask automatic recalculation and effectively turn off the "enforcing mode".

  3. There are a couple of side effects implicitly affecting standard file group permissions when using ACLs:

    1. Named user or group ACL entry applied to a file can change the ACL mask (increase it's permissions) and hence the effective file group permissions. For example if you, as a file owner, have "rw-r–r– jim students" permissions set on it and you also grant rw permission to the user "jack", you'll also implicitly grant rw permissions to anyone from the "students" group.
    2. Stricter (less permissions) ACL mask can permanently remove corresponding standard file group permissions. E.g. if you have a file with rw standard file group permissions and you apply a read-only ACL mask to the file it's group permissions will decrease to read-only. Then if you remove all extended ACL entries (with setfacl -b command), the group permissions will stay read-only. This applies only to stricter ACL mask, softer ACL mask (more permissions) don't permanently alter original file group permission after it is removed.

Best Answer

It doesn't make sense if the unix file permissions disagree to the acl entry and vice versa. Accordingly, the manual page (acl(5)) says what you ask for:

CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS

The permissions defined by ACLs are a superset of the permissions specified by the file permission bits.

There is a correspondence between the file owner, group, and other permissions and specific ACL entries: the owner permissions correspond to the permissions of the ACL_USER_OBJ entry. If the ACL has an ACL_MASK entry, the group permissions correspond to the permissions of the ACL_MASK entry. Otherwise, if the ACL has no ACL_MASK entry, the group permissions correspond to the permissions of the ACL_GROUP_OBJ entry. The other permissions correspond to the permissions of the ACL_OTHER_OBJ entry.

The file owner, group, and other permissions always match the permissions of the corresponding ACL entry. Modification of the file permission bits results in the modification of the associated ACL entries, and modification of these ACL entries results in the modification of the file permission bits.

Addendum in response to the discussion:

What is the reason for coupling ACL mask and file group permissions? What logic does lay behind it?

A good explanation is here. In essence the mask is an

[...] upper bound of the permissions that any entry in the group class will grant.

This upper bound property ensures that POSIX.1 applications that are unaware of ACLs will not suddenly and unexpectedly start to grant additional permissions once ACLs are supported.

In minimal ACLs, the group class permissions are identical to the owning group permissions. In extended ACLs, the group class may contain entries for additional users or groups. This results in a problem: some of these additional entries may contain permissions that are not contained in the owning group entry, so the owning group entry permissions may differ from the group class permissions.

This problem is solved by the virtue of the mask entry. With minimal ACLs, the group class permissions map to the owning group entry permissions. With extended ACLs, the group class permissions map to the mask entry permissions, whereas the owning group entry still defines the owning group permissions. The mapping of the group class permissions is no longer constant.

Related Question