Tag Info

Hot answers tagged

10

Actually, I believe the question was not about the (standard) file permission bits, but extended ACL information (see setfacl(1) or acl(5)). To my knowledge, the unmodified GNU tar ignores ACL information. (The man page for GNU tar 1.15.1 as shipped with RHEL 5.2 mentions switches --acls and --no-acls, but I haven't gotten them to work.) However, the star ...


6

The /home/alice/ directory needs executable access for the user accessing it. EDIT: BTW, the question marks are there to indicate that ls can't get the permissions on the file.


6

This is kind of a broad topic and a little too much to cover here. I'll refer you to the POSIX Access Control Lists on Linux whitepaper put together by Andreas Grünbacher of the SuSE Labs. It does a pretty good job of covering the subject and breaking it down so you understand how ACLs work. Your example Now let's take a look at your example and break it ...


6

This will probably get closed for soliciting opinions or being too broad but I'll do my best. "UNIX ACL" is a really indirect way of referring to it. I'm supposing you mean POSIX-style ACL's. The chief drawbacks there are with the lack of expressiveness in the number of operations you can specify since it just extends the traditional read/write/execute ...


6

The first command will change the permissions of any pre-existing files/directories. The -d in the second command is critical to setting the default permissions going forward for any directories, which in turn will provide a default set of ACLs for any files within these directories. NOTE: That in both instances the commands will run recursively via the -R ...


5

With normal unix permissions, you can't do this. With ACLs you can (or should be able to). You need to be using a filesystem that supports ACLs. Most modern linux filesystems do. The basic command is setfacl In your example, if group B owns directory /B you would add access rights for group D as follows: setfacl -m group:B:rwx,group:D:rwx /B This is ...


5

DAC == Discretionary Access Control, http://en.wikipedia.org/wiki/Discretionary_access_control MAC == Mandatory Access Control, http://en.wikipedia.org/wiki/Mandatory_access_control ACL == Access Control List, http://en.wikipedia.org/wiki/Access_control_list The ACL specifies the controls to be applied by the method of control, DAC or MAC. MAC is explicit, ...


5

ext3/4 file systems have a default mount options attribute in their headers. You can see it with: $ LC_ALL=C tune2fs -l /dev/device | grep 'Default mount options:' Default mount options: user_xattr acl You can change it with tune2fs -o and mounting with -o noacl would override it. When creating a new file system, mke2fs will set that based on what you ...


4

The + at the end indicates the presence of an access control list. An ACL on a file gives additional users or groups specific permissions, in addition to the traditional unix permissions which only distinguish between the owning user, the owning group and others. You can use getfacl to see the ACL on a file and setfacl to set it. cp -a would copy the ACL if ...


4

Here are 2 ways to do it: mount Using mount's -v switch: $ mount -v | grep /home/sam mulder:/export/raid1/home/sam on /home/sam type nfs (rw,intr,tcp,nfsvers=3,rsize=16384,wsize=16384,addr=192.168.1.1) nfsstat Using nfsstat -m: $ nfsstat -m | grep -A 1 /home/sam /home/sam from mulder:/export/raid1/home/sam Flags: ...


4

This is because the permissions are checked at every level to get to a directory, not just the target directory. You can give a user or group permission to pass though a directory without being able to access what is inside it by setting the execute bit for that user or group without setting either the read or write bits. For example: chmod 710 /home/$USER ...


4

Gah - facepalm! The -d switch is used for new files and directories within the lib directory. An explicit ACL must be defined for the lib directory itself. Remove the ACLs. user@host:/srv$ sudo setfacl -b lib user@host:/srv$ ls -l total 24 drwxr-x--- 2 root www-data 4096 May 21 19:06 lib drwx------ 2 root root 16384 Feb 17 18:22 lost+found ...


3

To be honest, the first thing I did with my RHEL6 OpenLDAP installation was to revert back to the legacy slapd.conf file-based configuration, since it's much more amendable to things like version control and Puppet. However... If you're familiar with the legacy configuration mechanism, you can set up your ACLs in a slapd.conf file and then use slaptest to ...


3

Your default ACLs replace the umask, which specifies not default permissions, but maximum permissions for creating new files. In this case rwxrwxr-x. Then your application calls open or creat with the permissions it wants. Just about all applications will ask for rw-rw-rw- for files. You can see this by running strace, e.g. $ strace -e trace=file touch ...


3

(I assume you're working on Linux, the workings of ACLs differ between unix variants.) cp doesn't do anything special when you copy the file; it creates the file with the mode of the original file, masked by the mask of the directory. Since cp doesn't do anything to the file's mask, the mask ends up being the intersection of the directory mask (rwx) and the ...


3

If you've quoted your command accurately as: find /opt/path -exec setacl -d user:myUser{} ';' you are missing a crucial space: find /opt/path -exec setacl -d user:myUser {} ';' The former invokes undefined (or maybe implementation-defined) behaviour from find; it might or might not expand the file name when the {} is not in an argument on its own. But ...


3

You'll notice the "effective" comment that getfacl is throwing out at you. The issue is that permissions are calculating so that "app" isn't getting the write bit set. That's happening because the mask on the file is set to read-only. The mask is used to limit the amount of permissions that could possibly be given out on a particular file or directory. An ...


3

Is there any approach out there which replaces this concept (probably per mount) with something simpler, where files inherit permissions from their containing directories by default? Yeah, they're called default ACLs: [root@ditirlns02 acl-test]# setfacl -m d:u:jadavis6:rwx --mask . [root@ditirlns02 acl-test]# getfacl . # file: . # owner: root # ...


3

I found this example, titled: ACL and MASK in linux. In this article the following examples are demonstrated which I think help to understand how ACL's and umask interact with each other. Background When a file is created on a Linux system the default permissions 0666 are applied whereas when a directory is created the default permissions 0777 are applied. ...


3

The exact details may depend on the filesystem, but conceptually, yes, the ACLs are metadata stored in the file inodes just like traditional permissions, dates, etc. Since the size of ACLs can vary, they may end up being stored in separate blocks. However the details only matter if you're designing a filesystem or programming a filesystem driver.


3

from man getfacl: The output format of getfacl is as follows: 1: # file: somedir/ 2: # owner: lisa 3: # group: staff 4: # flags: -s- [...] Line 4 indicates the setuid (s), setgid (s), and sticky (t) bits: either the letter representing the bit, or else a dash (-). This ...


3

setfacl has a recursive option (-R) just like chmod: -R, --recursive Apply operations to all files and directories recursively. This option cannot be mixed with `--restore'. it also allows for the use of the capital-x X permission, which means: execute only if the file is a directory or already has execute permission for some user ...


3

I've done this before using rsync -aHAX --delete remembering to add the -n and -i flags. This is slightly counterintuitive, but bear with me. The main rsync command is what you would need to sync the two directories together. But -n -i causes it NOT to sync (i.e. do a dry run) and just print out what it would have done and why. It isn't fantastic to parse, ...


3

In general, UNIX permissions are not that granular. A person with write access to a directory can create and delete files -- both operations write to the directory file. selinux would allow you to specify such a policy. (it'd be akin to swatting flies with a hammer, 'tho)


3

Use nfsstat -m it will display all the nfs mounted filesystem and theirs properties.


3

Linux/Solaris ACLs don't support this. You can't set different default ACLs for files and directories. Having directories that can be traversed but whose content cannot be listed (executable but not readable) is rarely useful. The fact that is works at all is a bit of a historical accident. Yes, it can occasionally be useful — but do you really need it? ...


2

I suggest you to use bsdtar. bsdtar backups extended ACL by default, it uses the same syntax as GNU tar, and the archives it produces are readable by GNU tar. The package and command name (under Debian based distributions) is bsdtar. bsdtar cf archive.tar /my/folder/using/extd_acl bsdtar xf archive.tar The 2nd (extract) command restores ACLs.


2

I'm looking for a solution as well so far I found this: first do a getfactl from my folder getfacl -R /a_folder > folder.acl then do a regular tar tar -czvf folder.tar.gz /a_folder when I extract it tar -xvf folder.tar.gz do a setfacl for the permissions. setfacl --restore=folder.acl this works for me.


2

rsync with the -A and/or -X options.


2

If you're looking for a simple-to-use yet powerful solution, I'd recommend rdiff-backup. Basically, it makes a copy of a source directory to a destination directory but it also saves additional information so you can go back in time to whenever you want. And, of course, it preserves symlinks, special files, hardlinks, permissions, uid/gid ownership and ...



Only top voted, non community-wiki answers of a minimum length are eligible