Using ACLs to give a group write access to /var/www/html without changing ownership

Why ACLs instead of changing ownership?

When a web server runs as www-data and the dev squad needs to touch files in /var/www/html, the quick fix is usually chgrp the directory and slap a write bit on the group. That swaps the group ownership, which can trip up services that expect the original group or automated deploy scripts that hard‑code the owner. ACLs let you hand out the right permissions without touching the classic ownership columns.

Prerequisites

ACL support must be turned on for the filesystem. Most modern distros mount ext4, XFS, or Btrfs with ACLs enabled out of the box. Verify with
```
tune2fs -l /dev/sdX | grep acl
```
or
```
mount | grep -i acl
```
The acl package has to be present (acl on Debian/Ubuntu, acl on RHEL, acl on Arch).
The group you want to give write access to must already exist, e.g. webdev.

sudo groupadd webdev

Setting the ACL

Give the group write access on the directory and all the files that are already there:

sudo setfacl -R -m g:webdev:rwX /var/www/html

-R – recursive.
-m – modify.
g:webdev:rwX – read, write, and execute (for directories) to the group.
The trailing X keeps execute only on directories and on files that already have it, so you don’t accidentally make new files world‑executable.

If you want new files to inherit the ACL automatically, add a default ACL:

sudo setfacl -R -d -m g:webdev:rwX /var/www/html

The -d flag creates a default ACL that applies to files created inside the directory.

Verifying the ACL

getfacl /var/www/html | grep webdev

You should see something along these lines:

# file: /var/www/html
# owner: www-data
# group: www-data
user::rwx
group::r-x
group:webdev:rw-
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:webdev:rw-

The mask line limits effective permissions; make sure it allows write (rwx) so the group can actually write.

Persisting across mounts

If /var/www/html lives on a separate partition, the mount options need to include acl. Edit /etc/fstab:

/dev/sdX1  /var/www/html  ext4  defaults,acl  0  2

Then remount:

sudo mount -o remount /var/www/html

Security considerations

Least privilege – Only give write to the exact group that needs it. Don’t add www-data to the group; the web server already runs as that user.
Mask limits – The ACL mask can silently block permissions. Keep it rwx unless you have a specific reason to tighten it.

Audit – Periodically run

getfacl -R /var/www/html | grep -v '^#' | sort | uniq -c | sort -n

to spot unexpected groups.

SELinux/AppArmor – On systems with mandatory access control, ACL changes may not be enough. Make sure the security context allows group writes, e.g. on RHEL:
```
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html(/.*)?"
```

Common pitfalls

Symptom	Cause	Fix
Group cannot create files	Mask is `r-x`	`sudo setfacl -m g:webdev:rwX /var/www/html`
New files lack group write	Default ACL missing	`sudo setfacl -d -m g:webdev:rwX /var/www/html`
Permissions revert after reboot	Mount options lack `acl`	Add `acl` to `/etc/fstab`

Cleaning up

If you later decide to remove the ACL:

sudo setfacl -R -x g:webdev /var/www/html
sudo setfacl -R -d -x g:webdev /var/www/html

Or reset to the original state:

sudo setfacl -R -b /var/www/html

TL;DR

Make sure ACLs are enabled and the acl package is installed.
Grant the group write: setfacl -R -m g:webdev:rwX /var/www/html.
Add a default ACL for new files: setfacl -R -d -m g:webdev:rwX /var/www/html.
Verify with getfacl.
Persist the ACLs by adding acl to the mount options in /etc/fstab.

ACLs give you fine‑grained control without changing ownership, keeping the web server’s default user intact while still letting developers collaborate safely.