Red Hat System Administration II

The Baker Street detective agency is setting up a collaborative share directory to hold case files, which members of the bakerstreet group will have read and write permissions on.

The lead detective, Sherlock Holmes, has decided that members of the scotlandyard group should also be able to read and write to the share directory. However, Holmes does not trust Inspector Peter Jones (a member of the scotlandyard group), and as such, Jones should have his access to the directory restricted to read-only.

Mrs. Hudson has created the user groups and has started the process of setting up the share directory, copying in some of the more recent case files. Since Sherlock would rather play his violin, it falls to you to finish the job.

Your task is to complete the setup of the share directory. The directory and all of its contents should be owned by the bakerstreet group, with the files updated to read and write for the owner and group (bakerstreet). Other users should have no permissions. You also need to provide read and write permissions for the scotlandyard group, with the exception of jones, who only gets read permissions. Make sure your setup applies to existing and future files.

Important information:

When you are done, run the command lab acl grade from your machine to verify your work.

1. The cases directory and its content should belong to group bakerstreet. New files added in the cases directory should automatically belong to the group bakerstreet. Existing files should be set to rw for user and group. (Hint: do not use setfacl.)

   1. Use chgrp to recursively update group ownership on the directory and its contents.

      [root@serverX ~]# chgrp -R bakerstreet /shares/cases

   2. Use chmod to update the setgid flag on the directory.

      [root@serverX ~]# chmod g+s /shares/cases

   3. Use chmod to update all existing file permissions to rw for owner and group.

      [root@serverX ~]# chmod 660 /shares/cases/*

   Hide Solution

2. Add ACLs to the cases directory (and its contents) that allow members of the scotlandyard group to have read/write access on the files and execute on the directory. Restrict user jones to read access on the files and execute on the directory.

   1. Use setfacl to recursively update the existing cases directory and its content. Grant the group scotlandyard read, write, and conditional execute permissions.

      [root@serverX ~]# setfacl -Rm g:scotlandyard:rwX /shares/cases

   2. Use setfacl to recursively update the existing cases directory and its content. Grant the user jones read and conditional execute permissions.

      [root@serverX ~]# setfacl -Rm u:jones:rX /shares/cases

   Hide Solution

3. Add ACLs that ensure any new file or directory in the cases directory have the correct permissions applied for ALL authorized users and groups.

   1. Use setfacl to update the default permissions for members of the scotlandyard group. Default permissions are read, write, and execute (needed for proper subdirectory creation and access).

      [root@serverX ~]# setfacl -m d:g:scotlandyard:rwx /shares/cases

   2. Use setfacl to update the default permissions for scotlandyard user jones. Default permissions are read and execute (needed for proper subdirectory access).

      [root@serverX ~]# setfacl -m d:u:jones:rx /shares/cases

   Hide Solution

4. Verify that you have made your ACL and file system changes correctly.

   Use ls and getfacl to review your settings on /shares/cases.

   From student, use sudo -i -u user to switch to both holmes and lestrade. Verify that you can write to a file, read from a file, make a directory, and write to a file in the new directory. Use ls to check the new directory permissions and getfacl to review the new directory ACLs.

   From student, use sudo -i -u jones to switch users. Try writing to a file (it should fail) and try to make a new directory (it should fail). As jones, you should be able to read from the adventures.txt file in the cases directory and read from the "test" file written in either of the new directories created by holmes and lestrade.

   Note

   The set of tests above are some of the tests you could perform to check that access permissions are correct. You should devise appropriate access validation tests for your environment.

   1. Use ls to check the cases directory and its content. Look for group ownership, directory and file permissions, the directory setgid flag, and the "+" indicating ACLs exist.

      [root@serverX ~]# ls -ld /shares/cases
      drwxrws---+ 2 root bakerstreet 46 Mar 18 06:56 /shares/cases
      [root@serverX ~]# ls -l /shares/cases
      total 16
      -rw-rw----+ 1 root bakerstreet 22 Mar 18 06:56 adventures.txt
      -rw-rw----+ 1 root bakerstreet  8 Mar 18 06:56 do_NOT_delete.grading.txt
      -rw-rw----+ 1 root bakerstreet 38 Mar 18 06:56 moriarty.txt

   2. Use getfacl and review its output. Look for the named user and named group entries in both the standard and default ACLs.

      [root@serverX ~]# getfacl /shares/cases
      getfacl: Removing leading '/' from absolute path names
      # file: shares/cases
      # owner: root
      # group: bakerstreet
      # flags: -s-
      user::rwx
      user:jones:r-x
      group::rwx
      group:scotlandyard:rwx
      mask::rwx
      other::---
      default:user::rwx
      default:user:jones:r-x
      default:group::rwx
      default:group:scotlandyard:rwx
      default:mask::rwx
      default:other::---

   3. Perform the following operations as holmes. Repeat as lestrade, replacing any reference to holmes in each of the commands. Check that you get the expected access behavior.

      [student@serverX ~]$ sudo -i -u holmes
      [holmes@serverX ~]$ cd /shares/cases
      [holmes@serverX cases]$ echo hello > holmes.txt
      [holmes@serverX cases]$ cat adventures.txt
      The Adventures of ...
      [holmes@serverX cases]$ mkdir holmes.dir
      [holmes@serverX cases]$ echo hello > holmes.dir/test.txt
      [holmes@serverX cases]$ ls -ld holmes.dir
      drwxrws---+ 2 holmes bakerstreet 21 Mar 18 07:35 holmes.dir
      [holmes@serverX cases]$ ls -l holmes.dir
      total 8
      -rw-rw----+ 1 holmes bakerstreet 6 Mar 18 07:39 test.txt
      [holmes@serverX cases]$ getfacl holmes.dir
      # file: holmes.dir
      # owner: holmes
      # group: bakerstreet
      # flags: -s-
      user::rwx
      user:jones:r-x
      group::rwx
      group:scotlandyard:rwx
      mask::rwx
      other::---
      default:user::rwx
      default:user:jones:r-x
      default:group::rwx
      default:group:scotlandyard:rwx
      default:mask::rwx
      default:other::---
      
      [holmes@serverX cases]$ exit
      logout
      [student@serverX ~]$ 

   4. Perform the following operations as jones. Check that you get the expected access behavior.

      [student@serverX ~]# sudo -i -u jones
      [jones@serverX ~]# cd /shares/cases
      [jones@serverX cases]# echo hello > jones.txt
      -bash: jones.txt: Permission denied
      [jones@serverX cases]# cat adventures.txt
      The Adventures of ...
      [jones@serverX cases]# mkdir jones.dir
      mkdir: cannot create directory ‘jones.dir’: Permission denied
      [jones@serverX cases]# cat holmes.dir/test.txt
      hello
      [jones@serverX cases]# exit
      logout
      [student@serverX ~]# 

   Hide Solution

5. When you are done, run the command lab acl grade from your serverX machine to verify your work.

   1. [student@serverX ~]$ lab acl grade

   Hide Solution