GNU Linux/Permissions/POSIX ACLs

From WhyAskWhy.org Wiki
< GNU Linux‎ | Permissions
Revision as of 11:54, 2 March 2015 by Deoren (talk | contribs) (Added overview, ACL types and entries)

Jump to: navigation, search


Overview

[1] [2]

POSIX Access Control Lists (ACLs) allow different permissions for different users or groups to be assigned to files or directories, independent of the original owner or the owning group. This means, in addition to the file owner, the file group, and others, additional users and groups can be granted or denied access by using POSIX ACLs. Said another way, the permissions defined by ACLs are a superset of hte permissions specified by the file permission bits.


Requirements for using ACLs

  • Supported by the filesystem used to store content
  • The filesystem is mounted with the acl option
  • The appropriate package containing the command-line setfacl and getfacl tools is installed
    • the package is named acl on Ubuntu
  • Current version of file utils (ls, cp, mv, etc) with support for working with ACLs

Confirm filesystem is mounted with proper support - tune2fs

You can use tune2fs -l /dev/X | grep acl (where X is the device).

sudo tune2fs -l /dev/sdaX | grep acl
Default mount options:    user_xattr acl

If it's not there, it would need to be added as a mount option for any filesystem that supports ACLs.

Confirm Kernel has support built-in [3]

Here we're looking in the @/boot/config-2.6.32-73-server@ kernel config file on an Ubuntu 10.04 LTS server to verify that the kernel was built with ACL support for the filesystem(s) that we're using. In our case we're only using Ext4, but as you can see below this kernel includes support for the other filesystems listed in the conf as well.

$ grep _ACL /boot/config-$(uname -r)
CONFIG_EXT2_FS_POSIX_ACL=y
CONFIG_EXT3_FS_POSIX_ACL=y
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_REISERFS_FS_POSIX_ACL=y
CONFIG_JFS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_OCFS2_FS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_GENERIC_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFSD_V2_ACL=y
CONFIG_NFSD_V3_ACL=y
CONFIG_NFS_ACL_SUPPORT=m


ACL Types

[2] [1]

Every object can be thought of as having associated with it an ACL that governs the discretionary access to that object; this ACL is referred to as an access ACL. In addition, a directory may have an associated ACL that governs the initial access ACL for objects created within that directory; this ACL is referred to as a default ACL.

  • Use access ACLs to grant permission to a specific file or directory
  • Use default ACLs to set permissions at the directory level for all files in the directory.

If a file inside that directory does not have an ACL, it inherits the permissions of the default ACLs of the directory. access ACLs can override default ACLs

ACL Entries

[4] [2]

Type Man Page Name Text Form Description
Owner ACL_USER_OBJ user::rwx This entry denotes access rights for the file owner.
Named User ACL_USER user:name:rwx These entries denote access rights for users identified by the entry's qualifier.
Owning Group ACL_GROUP_OBJ group::rwx This entry denotes access rights for the file group.
Named Group ACL_GROUP group:name:rwx These entries denote access rights for groups identified by the entry's qualifier.
Mask ACL_MASK mask::rwx This entry denotes the maximum access rights that can be granted by entries of type ACL_USER, ACL_GROUP_OBJ, or ACL_GROUP.
Other ACL_OTHER other::rwx This entry denotes access rights for processes that do not match any other entry in the ACL.

When an access check is performed, the ACL_USER_OBJ (owner) and ACL_USER (named user) entries are tested against the effective user ID. The effective group ID, as well as all supplementary group IDs are tested against the ACL_GROUP_OBJ (owning group) and ACL_GROUP (named group) entries.

Handling ACLs

Viewing ACLs

  • getfacl

Settings ACLs

  • setfacl

Misc

IBM's Tivoli Storage Manager [5]

File System ACL Support
XFS YES
EXT2 YES
EXT3 YES
EXT4 YES
GPFS YES
JFS NO
VxFS NO
EXT2 YES
NSS YES


TODO

Explain this:

 setfacl -d -m group:rwx /path/to/your/dir

It appears to be setting the Default ACL for the owning group to rwx (octal 777) for a specific directory. Presumably this means that inheritance would push those settings down to any newly created files/directories.

  • Q: What about existing files?
  • Q: What about existing directories?


Mask

The mask entry further limits the permissions granted by named user, named group, and owning group entries by defining which of the permissions in those entries are effective and which are masked. [4]

  • If permissions exist in one of the mentioned entries as well as the mask, they are effective.
  • Permissions contained only in the mask or only in the actual entry are not effective--meaning the permissions are not granted.
  • All permissions defined in the owner and owning group entries are always effective.


Removing POSIX ACLs

To remove all the permissions for a user, groups, or others, use the following command [6]:

setfacl -x ACL entry type file

For example, to remove all permissions from the user antony:

setfacl -x u:antony /mnt/gluster/data/test-file


References

Directly used

  1. 1.0 1.1 Support > Product Documentation > Red Hat Storage > 3.0 > Administration Guide > 7.6. POSIX Access Control Lists
  2. 2.0 2.1 2.2 acl(5) - Linux man page
  3. ACL(Access Control List) Configuration in Debian
  4. 4.0 4.1 Documentation > Security Guide > Local Security > Chapter 9. Access Control Lists in Linux
  5. IBM > Tivoli Software > File system and ACL support
  6. Support > Product Documentation > Red Hat Storage > 2.0 > Administration Guide > 9.5.3. Removing POSIX ACLs

Queued up