I use a dedicated backup user, and setfacl does allow inheritance of its acl on newly created things. I can't look it up now but I'm sure a Google search will f

I use a dedicated backup user, and setfacl does allow inheritance of its acl on newly created things. I can't look it up now but I'm sure a Google search will find it. It can also prevent the 640 as well because those acls are different than the normal mask. I think what you might be doing is applying a group acl instead of a user acl. In my setup I use normal Unix group permissions for some things, acls that apply group permissions for most things, but for homes I put my backup account as acl user permissions for read. Could you use root? Sure, but you would need to evaluate the risk in that. As root is "do all the things" account. The backup account can still read all the things so you still have data loss exposure but it can't modify the things.