mjhjmtu

I would like to set up a directory such that all new files are group writeable, regardless of the umask setting of the individual user.

I've created a stor group and added all users to it. Then, I created the folder:

$ mkdir uaroot
$ chgrp stor uaroot
$ ls -l
total 4
drwxr-xr-x 2 ua stor 512 Dec 27 14:35 uaroot

I set the ACLs for it:

$ setfacl -d -m u::rwx,g::rwx,o::rx,mask::rwx uaroot
$ setfacl -m u::rwx,g::rwx,o::rx,mask::rwx uaroot
$ ls -l
total 8
drwxrwxr-x+ 2 ua stor 512 Dec 27 14:35 uaroot

I can see the ACLs set as:

$ getfacl uaroot
# file: uaroot
# owner: ua
# group: stor
user::rwx
group::rwx
mask::rwx
other::r-x

$ getfacl -d uaroot
# file: uaroot
# owner: ua
# group: stor
user::rwx
group::rwx
mask::rwx
other::r-x

I thought this will have files inside this directory automatically get group writeable permission, but this wasn't the case:

$ cd uaroot
$ touch a
$ ls -l
total 4
-rw-r--r--+ 1 ua stor 0 Dec 27 14:38 a

$ getfacl a
# file: a
# owner: ua
# group: stor
user::rw-
group::rwx # effective: r--
mask::r--
other::r--

What does the effective callout mean above? What am I missing in order to have all files get group writeable permission?

You cancelled your earlier setting when you ran setfacl -m ::rwx,g::rwx,o::rx,mask::rwx uaroot, without the -d option and with the -m which modifies the current ACL settings on an object, rerun it with the -d to get what you want.

setfacl -d -m u::rwx,g::rwx,o::rx,mask::rwx uaroot

My test returns:

-rw-rw-r--+ 1 georgek georgek 0 Dec 28 08:04 koko/a

And note that the default keyword is missing as a result of you running that second setfacl command. You need to see

# file: koko/
# owner: georgek
# group: georgek
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::r-x

To be sure the defaults will apply to newly created files in that folder. And the getfacl for the created file for my test is

# file: koko/a
# owner: georgek
# group: georgek
user::rw-
group::rwx #effective:rw-
mask::rw-
other::r--