blob: e2e69a5bd0cbfa658e34665639dd694d8f0e7395 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
# access control list (acl)
> This describes `POSIX` acl.
The access control list provides a flexibel permission mechanism next to the
`UNIX` file permissions. This allows to specify fine grained permissions for
users/groups on filesystems.
Filesystems which support acl typically have an `acl` option, which must be
specified while mounting when it is not a default option.
Filesystems must be mounted with the `acl` option if not enabled as default
option.
Files or folder that have an `acl` defined, can be identified by the `+` sign
next to the UNIX permissions.
The following shows on example for a zfs filesystem.
```bash
# mount | grep tank
tank on /tank type zfs (rw,xattr,noacl)
tank/foo on /tank/foo type zfs (rw,xattr,posixacl)
# ls -h /tank
drwxrwxr-x+ 2 root root 4 11. Jun 14:26 foo/
```
## Show acl entries
```bash
# List current acl entries.
getfacl /tank/foo
```
## Modify acl entries
```bash
# Add acl entry for user "user123".
setfacl -m "u:user123:rwx" /tank/foo
# Remove entry for user "user123".
setfacl -x "u:user123" /tank/foo
# Add acl entry for group "group456".
setfacl -m "g:group456:rx" /tank/foo
# Add acl entry for others.
setfacl -m "o:rx" /tank/foo
# Remove extended acl entries.
setfacl -b /tank/foo
```
## Masking of acl entries
The `mask` defines the maximum access rights that can be given to **users** and
**groups**.
```bash
# Update the mask.
setfacl -m "m:rx" /tank/foo
# List acl entries.
getfacl /tank/foo
# file: tank/foo
# owner: root
# group: root
user::rwx
user:user123:rwx # effective:r-x
group::r-x
mask::r-x
other::rwx
```
## References
- [acl(5)][man-acl]
- [getfacl(1)][man-getfacl]
- [setfacl(1)][man-setfacl]
[man-acl]: https://www.man7.org/linux/man-pages/man5/acl.5.html
[man-getfacl]: https://www.man7.org/linux/man-pages/man1/getfacl.1.html
[man-setfacl]: https://www.man7.org/linux/man-pages/man1/setfacl.1.html
|
