Remember that you can never remove POSIX permissions (in fact ACLs are actually part of the current POSIX specification). You either have POSIX-only or POSIX+ACL. There is no ACL-only mode.
Given these permissions:
drwx------+ 8 admin dossierstaff 272 Mar 26 13:20 Test
0: group:dossierstaff allow list,add
file,search,addsubdirectory
1: user:_spotlight inherited allow list,search,file
inherit,directoryinherit
Only the user named admin has full read and write access to Test. Members of the group dossierstaff appear to have a limited capability to read, but can create files (add_file) and folders (add_subdirectory) under special circumstances.
To grant dossierstaff full read/write ability, you need to use the following ACL controls:
*Read - readattr, readextattr, readsecurity* Used for getting file or folder information, such as attributes and permissions. Required for read and read/write.
*Read - read and execute (files), and list and search (folders)* Used to grant read access to the contents of the item, to open the item, or to view and search a folder. Required for all read and read/write.
*Write - writeattr, writeextattr, delete* Used to set attributes for files/folders or to grant deletion ability to the item itself. Required for read/write.
*Write - write and append (files), delete, add_file, and add_subdirectory (folders)* Used to create a new file, add content to an existing file, or add or remove items from folders. Required for read/write.
For inheritance to newly-created or newly-copied items, use
file_inherit and
directory_inherit as well.
Here's an example:
sudo chmod -R +ai "group:dossierstaff allow readattr,readextattr,readsecurity,read,execute,list,search,\
writeattr,writeextattr,delete,write,append,delete,add
file,addsubdirectory,\
file
inherit,directoryinherit" /path/to/Test
*So why are delete controls required for write?* First of all, when most people say they want effective write permission, they're really meaning effective write and delete permission. Write permission is used for creating new items and appending content to existing items, but it's not full control. Some actions, such as renaming an item require delete permission to that item. Why? Because renaming an item is the same as moving it - just to the same folder - and moving an item requires that you be able to delete the previous reference from the filesystem. So, for technical reasons, moving and renaming require delete. And it's this reason why some (most) applications won't save to a folder that doesn't allow deletion. Many applications will create a temporary file, write the data to it, then rename it to match your request when instructed to Save or Save As. (TextEdit is a good example.) Further, some applications require the ability to create temporary scratch files in the destination folder and delete them later. (Adobe InDesign's use of *.idlk files is an excellent example here.)
--Gerrit
