ACLs finer grained permissions control

[grim76]

There has been more than one time where I have needed to allow more than a user or group access to some files. Also there are times when the group/user that has ownership is just too powerful for the purpose of access.

That is where ACLs come into play. Allowing a finer grained control over access to files and directories.

Caution using ACLs can be confusing at first and if not used properly can allow users access that you may not want.

First things first make sure that you have the ACL tools installed:

Note: I am using Oracle Enterprise Linux as my server so the package you need to install may be different.

# yum install acl

Once the install has been completed the next step is to make sure that your file system is mounted so that you can take advantage of ACLs.

Note: Not all file systems support ACLs please consult the mount options for your file system for clarification.

/dev/mapper/vg_system-lv_storage /storage                ext4    defaults,acl        1 2

Provided the file system is not in use:

# mount -o remount <path_to_filesystem>

In the event that the file system is in use you will need to either reboot, or wait for the file system to free up.

First thing to do is see what the ACL for your location looks like:

# getfacl <path>
[grim76@tardis /]$ getfacl storage
# file: storage
# owner: root
# group: root
user::rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:mask::rwx
default:other::r-x

Notice that this matches up pretty well with what you see from a standard ls -alh:

drwxrwxr-x   4 root root 4.0K Mar 31 21:14 storage

The goal of my exercise is to give my userid full control of a location, but not alter the base permissions that are in place.

Setting my user to have full control of the location:

# setfacl -m u:grim76:rwx /storage

Ok that is setfacl (command used to alter ACLs) -m (Modify) u(user):grim76(user):rwx(permissions) /storage(location).

Now lets look at ls -alh:

drwxrwxr-x+   4 root root 4.0K Mar 31 21:14 storage

Doesn't look like anything has changed, but look closer the + sign indicates that there is an ACL in place now.

Lets look at the ACL now:

[grim76@tardis /]$ getfacl storage
# file: storage
# owner: root
# group: root
user::rwx
user:grim76:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:mask::rwx
default:other::r-x

Now my user can add files and directories to that location. Problem is if root adds something to this location I won't get permissions to the files or locations.

So I need to change the default ACL behavior for this location:

setfacl -m d:u:grim76:rwx storage

Same command as before but with the added d. What this does is modifies the default behavior.

[grim76@tardis /]$ getfacl storage
# file: storage
# owner: root
# group: root
user::rwx
user:grim76:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:grim76:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

Notice the defaults section now has changed from the list we saw before.

Now files and directories that are created in that location will apply the ACL to allow my user to have full access.


This is a really simple example of how to use ACLs. These come in really handy for SFTP servers, and other file system access as well.

[DaReaper]

Very nice briefing on how to set it up. I think this would provide superior control over access to files in a directory, also since i'm using Lighttpd i don't have .htaccess and i was pretty much used to how .htaccess allowed me to control directory listing and access.

I was wondering how would the user be able to access the files with this? Is it via the terminal? or the browser?

[grim76]

This is more for via the terminal than via a browser. The browser would still be controlled vi its configuration. You can keep/allow the user that is running a service in or out of a location that way, but not all applications support ACL controls.

[Stefano Messicano]

If an ACL is present, it is consulted first! If someone is trying to access a file, and an ACE matches, the "can I or can't I" search stops, and the POSIX permissions don't even come into play. If there is no matching ACL, you 'fall through' to the POSIX permissions. ACLs are like firewall rules. They are read in order, and the first match determines the permissions.