Files and directories have permission sets for
the owner of the file, the group associated with the file, and all other users
for the system. However, these permission sets have limitations. For example,
different permissions cannot be configured for different users. Thus, Access
Control Lists (ACLs) were implemented.
The Red Hat Enterprise Linux kernel provides
ACL support for the ext3 file system and NFS-exported file systems. ACLs are
also recognized on ext3 file systems accessed via Samba.
Along with support in the kernel, the acl package is required to implement
ACLs. It contains the utilities used to add, modify, remove, and retrieve ACL
information.
The cp and mv commands copy or move any ACLs
associated with files and directories.
Before using ACLs for a file or directory, the partition for the
file or directory must be mounted with ACL support. If it is a local ext3 file
system, it can mounted with the following command:
mount -t ext3 -o acl device-name partition
For example:
mount -t ext3 -o acl /dev/VolGroup00/LogVol02
/work
Alternatively, if the partition is listed in the /etc/fstab file, the entry for the
partition can include the acl option:
LABEL=/work /work ext3
acl 1 2
If an ext3 file system is accessed via Samba and ACLs have
been enabled for it, the ACLs are recognized because Samba has been compiled
with the --with-acl-support option. No
special flags are required when accessing or mounting a Samba share.
By default, if the file system being exported by an NFS
server supports ACLs and the NFS client can read ACLs, then ACLs are utilized
by the client system. To disable ACLs on NFS share when mounting it on a
client, mount it with the noacl option with the command line.
SETTING ACCESS
ACLS
There are two types of ACLs: access ACLs and default
ACLs. An access ACL is the access control list for a specific file or
directory. A default ACL can only be associated with a directory; if a file
within the directory does not have an access ACL, it uses the rules of the default
ACL for the directory. Default ACLs are optional.
ACLs can be configured:
- Per user
- Per group
- Via the effective rights mask
- For users not in the user group
for the file
The setfacl utility
sets ACLs for files and directories. Use the -m option
to add or modify the ACL of a file or directory:
Rules (rules) must be specified in the following formats.
Multiple rules can be specified in the same command if they are separated by
commas.
u:uid:perms
Sets the access ACL for a user. The user name or UID may be
specified. The user may be any valid user on the system.
g:gid:perms
Sets the access ACL for a group. The group name or GID may be
specified. The group may be any valid group on the system.
m:perms
Sets the effective rights mask. The mask is the union of all
permissions of the owning group and all of the user and group entries.
o:perms
Sets the access ACL for users other than the ones in the group
for the file.
Permissions (perms) must be a combination of the
characters r, w, and x for
read, write, and execute.
If a file or directory already has an ACL, and the setfacl command is used, the
additional rules are added to the existing ACL or the existing rule is
modified.
Give read and write permissions
For example, to give read and write permissions to user alice:
# setfacl -m u:alice:rw
/project/somefile
To remove all the
permissions for a user, group, or others, use the -x option and do not specify any permissions:
Remove all permissions
For example, to remove all permissions from
the user with UID 500:
# setfacl -x u:500
/project/somefile
SETTING DEFAULT ACLS
To set a default ACL, add d: before
the rule and specify a directory instead of a file name.
Setting
default ACLs
For example, to set the default ACL for the /share/ directory to read and execute for users
not in the user group (an access ACL for an individual file can override it):
# setfacl -m d:o:rx /share
RETRIEVING ACLS
To determine the existing ACLs for a file or directory, use the getfacl command. In the example below, the getfacl is used to determine the existing ACLs
for a file.
Retrieving
ACLs
# getfacl home/john/picture.png
The above command returns the following output:
# file: home/john/picture.png
# owner: john
# group: john
user::rw-
group::r--
other::r--
If a directory with a default ACL is specified, the default ACL
is also displayed as illustrated below. For example, getfacl home/sales/ will display similar output:
# file: home/sales/
# owner: john
# group: john
user::rw-
user:barryg:r--
group::r--
mask::r--
other::r--
default:user::rwx
default:user:john:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
