From a85e47072ff808846242da49295b4b73af23b840 Mon Sep 17 00:00:00 2001 From: johannst Date: Wed, 21 Jun 2023 21:15:05 +0000 Subject: deploy: 35dc3c48a50594148554010ac626480161ad357a --- linux/acl.html | 265 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 265 insertions(+) create mode 100644 linux/acl.html (limited to 'linux/acl.html') diff --git a/linux/acl.html b/linux/acl.html new file mode 100644 index 0000000..4166152 --- /dev/null +++ b/linux/acl.html @@ -0,0 +1,265 @@ + + + + + + acl - Notes + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + + + + + + + + + + + +
+ +
+ + + + + + + + +
+
+

access control list (acl)

+
+

This describes POSIX acl.

+
+

The access control list provides a flexibel permission mechanism next to the +UNIX file permissions. This allows to specify fine grained permissions for +users/groups on filesystems.

+

Filesystems which support acl typically have an acl option, which must be +specified while mounting when it is not a default option. +Filesystems must be mounted with the acl option if not enabled as default +option.

+

Files or folder that have an acl defined, can be identified by the + sign +next to the UNIX permissions.

+

The following shows on example for a zfs filesystem.

+
# mount | grep tank
+tank on /tank type zfs (rw,xattr,noacl)
+tank/foo on /tank/foo type zfs (rw,xattr,posixacl)
+
+# ls -h /tank
+drwxrwxr-x+ 2 root root 4 11. Jun 14:26 foo/
+
+

Show acl entries

+
# List current acl entries.
+getfacl /tank/foo
+
+

Modify acl entries

+
# Add acl entry for user "user123".
+setfacl -m "u:user123:rwx" /tank/foo
+
+# Remove entry for user "user123".
+setfacl -x "u:user123" /tank/foo
+
+# Add acl entry for group "group456".
+setfacl -m "g:group456:rx" /tank/foo
+
+# Add acl entry for others.
+setfacl -m "o:rx" /tank/foo
+
+# Remove extended acl entries.
+setfacl -b /tank/foo
+
+

Masking of acl entries

+

The mask defines the maximum access rights that can be given to users and +groups.

+
# Update the mask.
+setfacl -m "m:rx" /tank/foo
+
+# List acl entries.
+getfacl /tank/foo
+# file: tank/foo
+# owner: root
+# group: root
+user::rwx
+user:user123:rwx     # effective:r-x
+group::r-x
+mask::r-x
+other::rwx
+
+

References

+ + +
+ + +
+
+ + + +
+ + + + + + + + + + + + + + + + + + +
+ + -- cgit v1.2.3