Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
The mask is the upper bound of permissions granted to any entry in the group class. The group class consists of named users and named groups plus the owning group. When a user adds a named user or group to the ACL and grants it permissions, the mask must be updated to include those permissions. This is described in https://www.usenix.org/legacy/publications/library/proceedings/usenix03/tech/freenix03/full_papers/gruenbacher/gruenbacher_html/main.html.
So we need to update the mask every time a named user, named group, or the owning group has a change in permissions.