Hi, I've been playing around with POSIX acls on a NetBSD 10.1 system.
The file system is FFSv2ea, has posix acls enabled and is mounted with the posix1eacls option. # dumpfs /local file system: /dev/rdk4 format FFSv2ea endian little-endian ... flags posix1e acls wapbl ... # mount | grep /local /dev/dk4 on /local type ffs (posix1eacls, log, local) The ACLs themselves seem to work (I can give another user permission to write into one of my directories). I didn't try with a group ACL, but suspect that would also have worked. But I can't set a default ACL on a directory that ensures that any files or directories created in it will have group write permission, either for the directory's group owner, or for another group. First attempt: % mkdir test % getfacl test # file: test # owner: duncan # group: ecs user::rwx group::r-x other::--- % setfacl -d -m g::rwx test setfacl: test: acl_calc_mask() failed: Invalid argument setfacl: test: failed to set ACL mask % setfacl -d -m g::rwx,m::rwx test setfacl: test: acl_set_file() failed: Invalid argument % Then I saw the bit in the setfacl man page that said "It should be noted that before you can specify a default ACL, the mandatory ACL entries for user, group, other and mask must be set." So I tried the following: % rm -r test && mkdir test % ls -l total 2 drwxr-x--- 2 duncan ecs 512 Jul 17 15:12 test % setfacl -m u::rwx,g::rwx,o::r-x,m::rwx test % ls -ldl test drwxrwxr-x+ 2 duncan ecs 512 Jul 17 15:14 test % getfacl test # file: test # owner: duncan # group: ecs user::rwx group::r-x mask::rwx other::r-x % setfacl -d -m g::rwx test setfacl: test: acl_calc_mask() failed: Invalid argument setfacl: test: failed to set ACL mask % setfacl -d -m g:src:rwx,m::rwx test setfacl: test: acl_set_file() failed: Invalid argument Finally, I've tried adding a -d to the first setfacl command (although that seems counter to man page claim that mandatory ACL entries for user, group, other and mask must be set before setting a default). That seemed to get a bit further... % rm -r test && mkdir test % setfacl -d -m u::rwx,g::rwx,o::---,m::rwx test % setfacl -d -m g:src:rwx,m::rwx test % touch test/xxx getfacl test/xxx # file: test/xxx # owner: duncan # group: ecs user::rw- group::rwx # effective: r-- group:src:rwx # effective: r-- mask::r-- other::--- % So group "src" only has "r" access to "xxx" (due to the mask?) whereas I wanted the default ACL specified for "test" to give that group "rw" access to test/xxx. If I do something similar on a Linux system it seems to work better... % uname -a Linux xxx 7.0.11-arch1-1 #1 SMP PREEMPT_DYNAMIC Tue, 02 Jun 2026 18:26:58 +0000 x86_64 GNU/Linux % mkdir test % setfacl -d g:src:rwx test % getfacl test # file: test # owner: duncan # group: ecs user::rwx group::r-x other::--- default:user::rwx default:group::r-x default:group:src:rwx default:mask::rwx default:other::--- % touch test/xxx % getfacl test/xxx # file: test/xxx # owner: duncan # group: ecs user::rw- group::r-x #effective:r-- group:src:rwx #effective:rw- mask::rw- other::--- Can someone tell me what I'm missing here? Thanks, Duncan
