`ls` says the group has rwx, but access is denied — that's the ACL mask lying to you
I wanted a second local account to read /home/davidw. The user was already in group davidw, and ls looked like it should just work:
$ ls -ld /home/davidw
drwxrwx---+ 272 davidw davidw 16384 Aug 19 16:56 /home/davidw
Group davidw has rwx, right there in the middle. Except every access failed:
$ sudo -u desk ls /home/davidw
ls: cannot open directory '/home/davidw': Permission denied
The + at the end of the mode string is the tell. Once a file has a POSIX ACL, the middle triad printed by ls stops being the group permission and becomes the ACL mask — a ceiling on what every named user, named group, and the owning group may get. The real group entry is only visible via getfacl:
$ getfacl -p /home/davidw
user::rwx
user:libvirt-qemu:--x
group::--- <-- the actual group permission: nothing
mask::rwx <-- this is what ls printed as "rwx"
other::---
So the directory was 700 all along. Someone (libvirt, in my case) added user:libvirt-qemu:--x at some point, and adding any named entry forces a mask into existence — set wide enough to cover that entry. ls dutifully displayed the mask, and it looked exactly like group access.
The mask cuts both ways: it can also revoke access that getfacl seems to grant. An entry of user:desk:rwx under mask::r-x yields read-only — getfacl marks it for you:
user:desk:rwx #effective:r-x
Two consequences worth internalizing. First, on any path with a +, getfacl is the only source of truth; don't reason from ls. Second, chmod g+rx on an ACL'd file doesn't set the group permission — it sets the mask, which is almost never what you meant. Grant access with a named entry instead, which is narrower and trivially reversible:
sudo setfacl -m u:desk:rwx /home/davidw # grant
sudo setfacl -x u:desk /home/davidw # revert
One unrelated snag if you're doing this to share a checkout: git will refuse the now-reachable repos with detected dubious ownership in repository, because they're owned by a different uid. Fix it per-user, not with sudo:
sudo -u desk git config --global --add safe.directory '*'