0
Let me introduce you to margaret and pepijn, my two LDAP users.
Pepijn is at the bottom of my non-existent corporation's food chain and is therefore member of only one LDAP-group:
pepijn@srv:/$ groups
user
Margaret is one of the more fortunate:
margaret@srv:/$ groups
user SVNAccess www-writers book-writers
I've set an ACL with defaults for /files/books, so that members of book-writers have rwx access and members of user have only r access.
# file: files/books/
# owner: root
# group: book-writers
user::rwx
group::r--
group:user:r--
group:book-writers:rwx
mask::rwx
other::---
default:user::rwx
default:group::r--
default:group:user:r--
default:group:book-writers:rwx
default:mask::rwx
default:other::---
Margaret writes some data to the file /files/books/test.txt. Pepijn then tries to take a look at the contents of the file, but is rather disappointed when he gets presented with an Access Denied error.
When I run getfacl on the file it returns this:
# file: files/books/test.txt
# owner: margaret
# group: user
user::rw-
group::r--
group:user:r--
group:book-writers:rwx #effective:rw-
mask::rw-
other::---
Why isn't Pepijn able to view the content of Margaret's file?