Red Hat System Administration II

Objectives

After completing this section, you should be able to:

Changing ACL File Permissions

Use setfacl to add, modify, or remove standard ACLs on files and directories.

ACLs use the normal file system representation of permissions, "r" for read permission, "w" for write permission, and "x" for execute permission. A "-" (dash) indicates that the relevant permission is absent. When (recursively) setting ACLs, an uppercase "X" can be used to indicate that execute permission should only be set on directories and not regular files, unless the file already has the relevant execute permission. This is the same behavior as chmod.

Adding or Modifying ACLs

ACLs can be set via the command-line using the -m option, or passed in via a file using the -M option (use "-" (dash) instead of a file name for stdin). These two options are the "modify" options; they add new ACL entries or replace specific existing ACL entries on a file or directory. Any other existing ACL entries on the file or directory remain untouched.

When first defining an ACL on a file, if the add operation does not include settings for the file owner, group owner, or other permissions, then these will be set based on the current standard file permissions (these are also known as the base ACL entries and cannot be deleted), and a new mask value will be calculated and added as well.

To add or modify a user or named user ACL:

[user@host ~]$ setfacl -m u:name:rX file

If name is left blank, then it applies to the file owner, otherwise name can be a username or UID value. In this example, the permissions granted would be read-only, and if already set, execute (unless file was a directory, in which case the directory would get the execute permission set to allow directory search).

ACL file owner and standard file owner permissions are equivalent; consequently, using chmod on the file owner permissions is equivalent to using setfacl on the file owner permissions. chmod has no effect on named users.

To add or modify a group or named group ACL:

[user@host ~]$ setfacl -m g:name:rw file

This follows the same pattern for adding or modifying a user ACL entry. If name is left blank, then it applies to the group owner. Otherwise, specify a group name or GID value for a named group. The permissions would be read and write in this example.

chmod has no effect on any group permissions for files with ACL settings, but it updates the ACL mask.

To add or modify the other ACL:

[user@host ~]$ setfacl -m o::- file

other only accepts permission settings. Typical permission settings for others are: no permissions at all, set with a dash (-); and read-only permissions set as usual with r. Of course, you can set any of the standard permissions.

ACL other and standard other permissions are equivalent, so using chmod on the other permissions is equivalent to using setfacl on the other permissions.

You can add multiple entries with the same command; use a comma-separated list of entries:

[user@host ~]$ setfacl -m u::rwx,g:consultants:rX,o::- file

This sets the file owner to read, write, and execute, sets the named group consultants to read-only and conditional execute, and restricts all other users to no permissions. The group owner maintains existing file or ACL permissions and other "named" entries remain unchanged.

Using getfacl as Input

You can use the output from getfacl as input to setfacl:

[user@host ~]$ getfacl file-A | setfacl --set-file=- file-B

The --set-file option accepts input from a file or from stdin. The dash character (-) specifies the use of stdin. In this case, file-B will have the same ACL settings as file-A.

Setting an Explicit ACL Mask

You can set an ACL mask explicitly on a file or directory to limit the maximum effective permissions for named users, the group owner, and named groups. This restricts any existing permissions that exceed the mask, but does not affect permissions that are less permissive than the mask.

[user@host ~]$ setfacl -m m::r file

This adds a mask value that restricts any named users, the group owner, and any named groups to read-only permission, regardless of their existing settings. The file owner and other users are not impacted by the mask setting.

getfacl shows an effective comment beside entries that are restricted by a mask setting.

Recursive ACL Modifications

When setting an ACL on a directory, use the -R option to apply the ACL recursively. Remember that you are likely to want to use the "X" (capital X) permission with recursion so that files with the execute permission set retain the setting and directories get the execute permission set to allow directory search. It is considered good practice to also use the uppercase "X" when non-recursively setting ACLs because it prevents administrators from accidentally adding execute permissions to a regular file.

[user@host ~]$ setfacl -R -m u:name:rX directory

This adds the user name to the directory directory and all existing files and subdirectories, setting read-only and conditional execute permissions.

Deleting ACLs

Deleting specific ACL entries follows the same basic format as the modify operation, except that ":perms" is not specified.

[user@host ~]$ setfacl -x u:name,g:name file

This removes only the named user and the named group from the file or directory ACL. Any other existing ACL entries remain active.

You can include both the delete (-x) and modify (-m) operations in the same setfacl operation.

The mask can only be deleted if there are no other ACLs set (excluding the base ACL which cannot be deleted), so it must be deleted last. The file will no longer have any ACLs and ls -l will not show the plus sign (+) next to the permissions string. Alternatively, to delete all ACL entries on a file or directory (including default ACL on directories), use the following command:

[user@host ~]$ setfacl -b file

Controlling Default ACL File Permissions

To ensure that files and directories created within a directory inherit certain ACLs, use the default ACL on a directory. You can set a default ACL and any of the standard ACL settings, including a default mask.

The directory itself still requires standard ACLs for access control because the default ACLs do not implement access control for the directory; they only provide ACL permission inheritance support. For example:

[user@host ~]$ setfacl -m d:u:name:rx directory

This adds a default named user (d:u:name) with read-only permission and execute permission on subdirectories.

The setfacl command for adding a default ACL for each of the ACL types is exactly the same as for standard ACLs, but prefaced with d:. Alternatively, use the -d option on the command line.

Deleting Default ACL Entries

Delete a default ACL the same way that you delete a standard ACL, prefacing with d:, or use the -d option.

[user@host ~]$ setfacl -x d:u:name directory

This removes the default ACL entry that was added in the previous example.

To delete all default ACL entries on a directory, use setfacl -k directory.