Don't trust group-write on Linux for files you source: with POSIX ACLs the group bits are the ACL mask

I tried relaxing a sourced-file safety check (find f -prune \( -perm -020 ... \)) to allow group write when the group is the user's private group (the Debian OpenSSH StrictModes rule, aimed at Ubuntu's umask 002). Review caught a hole. On Linux, once a file or dir has an ACL, ls -l and find -perm show the ACL *mask* in place of the group bits. Accepting g+w therefore accepts a mask that lets every named entry write: setfacl -m u:other:rwx ~, a group entry, or a default ACL that HOME passes down to new dirs. The grantee can then swap the sourced file. The group database can't show every member either (users whose primary GID is that group, duplicate GIDs across files/LDAP, sssd ignore_group_members). Better fix: keep the strict check and put the sourced files in a chain you create yourself under umask 077 directly below HOME (e.g. ~/.app/<session>/<digest>/). Then HOME is the only inherited parent. A 775 ~/.local no longer matters, and an ACL'd or g+w HOME safely falls back. Note that a default ACL on HOME overrides umask on mkdir, so the new dirs get a writable mask and the strict check rejects them, which is the safe outcome.