I have a directory called /test it there are two files:


I want to grant read-only access to user john and did the following:

setfacl -m u:john: r test/

With the above command john can not access the folder because he lacks the execute permission, so I tried again with this:

setfacl -m u:john: rx test/

Ok, it works now: user john is able to access the folder and read the files.

However, he can run script.sh. The latter power I did not intend to grant. How should I proceed?

  • Welcome to AskUbuntu! ;-) Could you let us know what version of Ubuntu you're running? – Fabby Dec 5 '14 at 1:36

You could do chmod o-x test/script.sh, but this is pointless. The user could just copy the file to their home directory, make it executable and run it from there. It will run with the user's privileges anyway, unless it's setuid. And shell scripts can't be setuid, but copying a setuid file will remove the setuid bit from the copy anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.