1

I have the following code in a bash file:

sudo setfacl -m g:jobq:x /usr/local/sbin/jobq_submit
sudo setfacl -m g:jobq:x /usr/local/sbin/jobq_server
sudo setfacl -m g:jobq:x /usr/local/sbin/jobq_server_stop
sudo setfacl -m g:jobq:x /usr/local/sbin/jobq_server_start
sudo setfacl -m g:jobq:x /usr/local/sbin/jobq_status
sudo setfacl -m g:jobq:x /usr/local/sbin/jobq_stop

sudo setfacl -x g:jobq:rw /usr/local/sbin/jobq_submit
sudo setfacl -x g:jobq:rw /usr/local/sbin/jobq_server
sudo setfacl -x g:jobq:rw /usr/local/sbin/jobq_server_stop
sudo setfacl -x g:jobq:rw /usr/local/sbin/jobq_server_start
sudo setfacl -x g:jobq:rw /usr/local/sbin/jobq_status
sudo setfacl -x g:jobq:rw /usr/local/sbin/jobq_stop
sudo setfacl -x g:jobq:rw /usr/local/sbin/jobq_submit

The lines with -m do not give an error message, but the lines with -x say

setfacl: Option -x: Invalid argument near character 8

What is wrong here?

infinitezero
  • 187
  • 1
  • 7

1 Answers1

2

setfacl -x only takes a reference to the ACL to remove, not the permissions associated with the ACL:

sudo setfacl -x g:jobq /usr/local/sbin/jobq_submit
Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
  • So can we only set full set of permissions, not change one at time? – realtebo Jun 27 '22 at 20:19
  • Yes, `setfacl -m` takes a full set of permissions for the given ACL; you can’t add `x` and remove `rw` from a given ACL. `setfacl -m g:jobq:x` sets the ACL for group `jobq` to be only `x`. – Stephen Kitt Jun 27 '22 at 21:28