Is there a way to use ACL to have multiple groups owning one folder?

Question

So just like the title says I am wondering if there is away for me to have multiple groups owning one folder with an ACL?

I would like to have these Groups

1. ftp_read
   • I would like to have read set for that group
2. ftp_read_write
   • I would like to have read, write set for that group
3. ftp_read_write_execute
   • I would like to have read, write, execute set for that group

I seems like this would be possible I am not positive.

Answer 1

Yes, you can have entries for multiple groups in an ACL – that's actually the whole point of the ACL feature.

(Except you don't need to have the groups "own" the folder in any way. Aside from disk quotas, the "main" group doesn't receive any special privileges that an owner would, so you could instead pretend the opposite, that the "group ownership" is just a limited 1-entry ACL.)

So in setfacl terms, your ACL would look like:

g:ftp_read:r, g:ftp_read_write:rw, g:ftp_read_write_execute:rwx

---

Though it doesn't look like a very useful set of permissions to me. Over FTP, users cannot execute arbitrary files anyway, no matter the permissions. Meanwhile, they require the execute permissions on directories – having just +r access on a directory merely allows you to see the filenames.

This seems more useful:

g:ftp_read:rx, g:ftp_read_write:rwx

You can set this as the default ACL for a directory and the POSIX ACL system will automatically "mask" +x on newly created files, resulting in +r for files but +rx for directories.

Answer 2

Check out this question on AskUbuntu.

In short, once you enable ACLs in the mount options, you can use commands such as

setfacl -m g:ftp_read:r folder
setfacl -m g:ftp_read_write:rw folder
setfacl -m g:ftp_read_write_execute:rwx folder