How can I set default permission with ACL in linux?

Question

I have two groups group1 and group2.

I need group1 users to be able to read-write (rwx) files owned by users in group2, but users in group2 cannot write to (r-x) files from group1.

All users in a group can read, but not write to, files on the same group (r-x)

I know that I can use ACL (Access Control Lists) to deal with it.

setfacl -m g:group1:rwx "directory owned by a group2 user"

the problem is that it must be set for every new folder. is there a way to set as default so that every new group2 user's file/folder have this permission applied?

will this default be applied if I create a new user in group2?

I know that the normal permissions are copied from /etc/skel to the home folder when a new user is created, but how to make the acl permissions to be copied too?

Answer 1

For default permissions its "-d". So you can use this:

setfacl -d -m g:group1:rwx "Main directory owned by group2 user"

Also do check the effective rights with getfacl. You may have to set the mask also.

Answer 2

You don't need ACLs.

Put all users from group1 also into group2. Then ensure you put the setgid bit the directories: all new files will owned by the directory owner, with similar permissions (setgid will be added to new subdirs).

# Setup as root
mkdir -p /tmp/test/1
chgrp group1 /tmp/test/1
chmod g+wsx,o= /tmp/test/1
mkdir -p /tmp/test/2
chgrp group2 /tmp/test/2
chmod g+ws,o= /tmp/test/2
# user1 is in groups users (primary gid), group1, group2 
# user2 is in groups users (primary gid), group2
# as user1:users
mkdir -p /tmp/test/{1,2}/d1
touch /tmp/test/{1,2}/{f1,d1/f1}
# as user2:users
mkdir -p /tmp/test/{1,2}/d2
touch /tmp/test/{1,2}/{f2,d2/f2}
# check the ownerships on everything
ls -la /tmp/test/{1,2}/{f{1,2},d{1,2},d{1,2}/f{1,2}}

If you do want to stick with ACLs, you need to look at default ACLs, you do similar to the above with them.

As for adding new users and /etc/skel/, I'm afraid you're out of luck there, the stock useradd command does not preserve any ACLs or xattrs when copying /etc/skel/.