Tag Info

Hot answers tagged

50

If at all possible, use access control lists (ACL). Under Linux, make sure that the filesystem you're using supports ACLs (most unix filesystems do). You may need to change the mount options to enable ACLs: with ext2/ext3/ext4, you need to specify the acl mount option explicitly, so the entry in /etc/fstab should look like /dev/sda1 / ext4 ...


36

You can control the assigned permission bits with umask, and the group by making the directory setgid to G. $ umask 002 # allow group write; everyone must do this $ chgrp G . # set directory group to G $ chmod g+s . # files created in directory will be in group G Note that you have to do the chgrp/chmod for every ...


13

Here are 2 ways to do it: mount Using mount's -v switch: $ mount -v | grep /home/sam mulder:/export/raid1/home/sam on /home/sam type nfs (rw,intr,tcp,nfsvers=3,rsize=16384,wsize=16384,addr=192.168.1.1) nfsstat Using nfsstat -m: $ nfsstat -m | grep -A 1 /home/sam /home/sam from mulder:/export/raid1/home/sam Flags: ...


12

This question is a good fit for linux acl. Since you don't state your OS, I'll assume Linux in what follows. Here is an example session. I don't know of a really good acl tutorial, but you could do worse than http://www.vanemery.com/Linux/ACL/linux-acl.html Note that the default acl behaves like a local umask. Since at least in Linux, umasks are applied ...


10

Actually, I believe the question was not about the (standard) file permission bits, but extended ACL information (see setfacl(1) or acl(5)). To my knowledge, the unmodified GNU tar ignores ACL information. (The man page for GNU tar 1.15.1 as shipped with RHEL 5.2 mentions switches --acls and --no-acls, but I haven't gotten them to work.) However, the star ...


8

The first command will change the permissions of any pre-existing files/directories. The -d in the second command is critical to setting the default permissions going forward for any directories, which in turn will provide a default set of ACLs for any files within these directories. NOTE: That in both instances the commands will run recursively via the -R ...


7

DAC == Discretionary Access Control, http://en.wikipedia.org/wiki/Discretionary_access_control MAC == Mandatory Access Control, http://en.wikipedia.org/wiki/Mandatory_access_control ACL == Access Control List, http://en.wikipedia.org/wiki/Access_control_list The ACL specifies the controls to be applied by the method of control, DAC or MAC. MAC is explicit, ...


7

Use nfsstat -m it will display all the nfs mounted filesystem and theirs properties.


7

ext3/4 file systems have a default mount options attribute in their headers. You can see it with: $ LC_ALL=C tune2fs -l /dev/device | grep 'Default mount options:' Default mount options: user_xattr acl You can change it with tune2fs -o and mounting with -o noacl would override it. When creating a new file system, mke2fs will set that based on what you ...


6

The /home/alice/ directory needs executable access for the user accessing it. EDIT: BTW, the question marks are there to indicate that ls can't get the permissions on the file.


6

This is kind of a broad topic and a little too much to cover here. I'll refer you to the POSIX Access Control Lists on Linux whitepaper put together by Andreas Gr├╝nbacher of the SuSE Labs. It does a pretty good job of covering the subject and breaking it down so you understand how ACLs work. Your example Now let's take a look at your example and break it ...


6

setfacl has a recursive option (-R) just like chmod: -R, --recursive Apply operations to all files and directories recursively. This option cannot be mixed with `--restore'. it also allows for the use of the capital-x X permission, which means: execute only if the file is a directory or already has execute permission for some user ...


6

This will probably get closed for soliciting opinions or being too broad but I'll do my best. "UNIX ACL" is a really indirect way of referring to it. I'm supposing you mean POSIX-style ACL's. The chief drawbacks there are with the lack of expressiveness in the number of operations you can specify since it just extends the traditional read/write/execute ...


6

You could use bindfs like: $ ls -ld dir drwxr-xr-t 2 stephane stephane 4096 Aug 12 12:28 dir/ That directory is owned by stephane, with group stephane (stephane being its only member). Also note the t that prevents users from renaming or removing entries that they don't own. $ sudo bindfs -u root -p u=rwD,g=r,dg=rwx,o=rD dir dir We bindfs dir over ...


5

I'm looking for a solution as well so far I found this: first do a getfactl from my folder getfacl -R /a_folder > folder.acl then do a regular tar tar -czvf folder.tar.gz /a_folder when I extract it tar -xvf folder.tar.gz do a setfacl for the permissions. setfacl --restore=folder.acl this works for me.


5

With normal unix permissions, you can't do this. With ACLs you can (or should be able to). You need to be using a filesystem that supports ACLs. Most modern linux filesystems do. The basic command is setfacl In your example, if group B owns directory /B you would add access rights for group D as follows: setfacl -m group:B:rwx,group:D:rwx /B This is ...


4

The + at the end indicates the presence of an access control list. An ACL on a file gives additional users or groups specific permissions, in addition to the traditional unix permissions which only distinguish between the owning user, the owning group and others. You can use getfacl to see the ACL on a file and setfacl to set it. cp -a would copy the ACL if ...


4

If we have a look at the acl(5) man page, we see: CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS The permissions defined by ACLs are a superset of the permissions specified by the file permission bits. There is a correspondence between the file owner, group, and other permissions and specific ACL entries: the owner permissions ...


4

The exact details may depend on the filesystem, but conceptually, yes, the ACLs are metadata stored in the file inodes just like traditional permissions, dates, etc. Since the size of ACLs can vary, they may end up being stored in separate blocks. However the details only matter if you're designing a filesystem or programming a filesystem driver.


4

With setfacl you can set default permissions but not default owner/group for newly created files. To get new files to be owned by a specific user, you'd need a setuid bit that works like the setgid bit on directories. Unfortunately that is not implemented. With setfacl you can do something which is nearly equivalent in most scenarios: You can set an ACL ...


4

I've done this before using rsync -aHAX --delete remembering to add the -n and -i flags. This is slightly counterintuitive, but bear with me. The main rsync command is what you would need to sync the two directories together. But -n -i causes it NOT to sync (i.e. do a dry run) and just print out what it would have done and why. It isn't fantastic to parse, ...


4

This is because the permissions are checked at every level to get to a directory, not just the target directory. You can give a user or group permission to pass though a directory without being able to access what is inside it by setting the execute bit for that user or group without setting either the read or write bits. For example: chmod 710 /home/$USER ...


4

Gah - facepalm! The -d switch is used for new files and directories within the lib directory. An explicit ACL must be defined for the lib directory itself. Remove the ACLs. user@host:/srv$ sudo setfacl -b lib user@host:/srv$ ls -l total 24 drwxr-x--- 2 root www-data 4096 May 21 19:06 lib drwx------ 2 root root 16384 Feb 17 18:22 lost+found ...


4

An empty permission set can be represented with -: setfacl -dm o::- mydir This doesn't appear to be documented, so I don't know how portable it is. However, the documentation does mention that they can be specified as an octal digit (4 r, 2 w, 1 x, as in chmod), so: setfacl -dm o::0 mydir


3

To be honest, the first thing I did with my RHEL6 OpenLDAP installation was to revert back to the legacy slapd.conf file-based configuration, since it's much more amendable to things like version control and Puppet. However... If you're familiar with the legacy configuration mechanism, you can set up your ACLs in a slapd.conf file and then use slaptest to ...


3

When a process performs an operation to a file, the Linux kernel performs the check in the following order: Discretionary Access Control (DAC) or user dictated access control. This includes both classic UNIX style permission checks and POSIX Access Control Lists (ACL). Classical UNIX checks compare the current process UID and GID versus the UID and GID of ...


3

(I assume you're working on Linux, the workings of ACLs differ between unix variants.) cp doesn't do anything special when you copy the file; it creates the file with the mode of the original file, masked by the mask of the directory. Since cp doesn't do anything to the file's mask, the mask ends up being the intersection of the directory mask (rwx) and the ...


3

From Debian Wiki: Since version 2.4.23-3 the configuration of OpenLDAP has been changed to /etc/ldap/slapd.d by default. So, OpenLDAP allow to configure itself dynamically through 'cn=config' tree. You can list DN in cn=config and see something like this: sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config dn ... # {1}hdb, config dn: ...


3

Procedure is very similar to procedure of changing password that I described in another question. There are also two ways. 1) Editing config file. You need to find config file of your backend. Each ACL is defined as value of olcAccess attribute. Syntax of ACL is identical as in "normal" slapd.conf file, but at the beginning of each ACL you must insert ...


3

If you've quoted your command accurately as: find /opt/path -exec setacl -d user:myUser{} ';' you are missing a crucial space: find /opt/path -exec setacl -d user:myUser {} ';' The former invokes undefined (or maybe implementation-defined) behaviour from find; it might or might not expand the file name when the {} is not in an argument on its own. But ...



Only top voted, non community-wiki answers of a minimum length are eligible