Preserve ability to set FACL

Question

Using setfacl on linux, seems like only owner (and root) can modify the ACL via setfacl, is that right?

If there is a directory owned by joe and joe grants rwx to marry, she can read any file, create new, delete old, make directory trees, etc. Everything seems to be fine, they share the content and can update each other's files.

But joe just wants to have ability to set ANY ACL, so in future he would like to allow linda to share his directory. But this is allowed only for the files he owns, so mary's files and directories are not accessible to change permission on.

The questions are:

• Is there a permission to change permission on ACL (anything else than rwx)?
• Is there any method how to set the owner of files/directories created by mary/linda to joe automagically via any ACL setup (repressive applying of chown -R fails for files not owned by joe)?

Edit
@grawity: I cannot comment, so I'll edit and try to explain the motivation here: the main point is that joe as the "shared directory manager" and owner wants to incrementally add/remove subsequent users (for simplicity all having the same rwx permissions):

setfacl -d -m u:linda:rwx
setfacl -m u:linda:rwx

He cannot create/alter any group, he is just regular user with uid > 0. I thought of transfering the ownership only, not the permissions. Imagine linda now creates a directory. New member jack enters the club, asks joe to add him to the list. But joe cannot alter other than his own directories... So jack cannot access files created by linda. joe would have to ask her to set permissions etc.

It might make more sense now.

Answer 1

Is there a permission to change permission on ACL (anything else than rwx)?

No, not in POSIX ACLs. Just like classic POSIX permission bits, only the owner may change them.

(It exists in Windows/NTFS/CIFS/NFSv4 ACLs, but that's mostly only relevant on FreeBSD anyway.)

Is there any method how to set the owner of files/directories created by mary/linda to joe automagically via any ACL setup (repressive applying of chown -R fails for files not owned by joe)?

No. However, I don't understand how it would help with sharing files; if anything, it'd only be worse – Mary creates a file but can't do anything with it until Joe grants access; meanwhile, Joe automatically gets access to all files created by Mary even if they weren't explicitly shared. This makes zero sense.

Setting default ACLs on the directory (u:joe:rwx,u:mary:rwx,u:linda:rwx or even g:family:rwx) should be enough for this purpose.