2

0. Add user bkupusr to group extbk

leeand00@hostname:/home/leeand00/$ sudo groupadd extbk
leeand00@hostname:/home/leeand00/$ sudo usermod -G extbk bkupusr

1. Created directory structure:

leeand00@hostname:/home/leeand00/$ mkdir appdir2
leeand00@hostname:/home/leeand00/$ mkdir appdir2/appuser1
leeand00@hostname:/home/leeand00/$ mkdir appdir2/appuser2

2. Setup the default permissions for anything else we create in there here after (no recursion for existing stuff)

leeand00@hostname:/home/leeand00/$ setfacl -dm g:extbk:r ./appdir2

3. Create a directory and a file:

leeand00@hostname:/home/leeand00/$ cd appdir2
leeand00@hostname:/home/leeand00/appdir2/$ touch file1
leeand00@hostname:/home/leeand00/appdir2/$ mkdir dir1
leeand00@hostname:/home/leeand00/appdir2/$ echo "Hi" >> file1

4. Stop other groups from reading and executing appdir2

leeand00@hostname:/home/leeand00/appdir2/$ cd ..
leeand00@hostname:/home/leeand00/$ chmod o-xr ./appdir2

5. Attempt to access from a user in the extbk group

bkuser@hostname:/home/leeand00/$ cd ./appdir2
bash: cd: appdir2: Permission denied

bkuser@hostname:/home/leeand00/$ cat ./appdir2/file1
cat: appdir2/file1: Permission denied

However if I change the other permissions as follows:

leeand00@hostname:/home/leeand00/$ chmod o+x ./appdir2

Then I am able to access the file again.

bkuser@hostname:/home/leeand00/$ cd ./appdir2
bkuser@hostname:/home/leeand00/$ cat ./appdir2/file1
hi

But then so can anyone else in another group...so is there a way to allow access only to the groups that are in the ACL, (and to the group and owner) without allowing access to other?

  • I am not in front of a terminal right now, but -- does it do what you expect if you use setfacl -dm g:extbk:rx ./appdir? – Jeff Schaller Jul 26 '15 at 14:00
  • Aw geez typo, sorry! But I don't believe it was a typo on my terminal. – leeand00 Jul 26 '15 at 17:47
  • Make sure your group has execute perms on the appdir as well. A getfacl on the appdir and file1 would help identify the "effective" permissions. – madflojo Jul 26 '15 at 17:59
  • @madflojo When you say group do you mean the default, acl, or posix group? – leeand00 Jul 26 '15 at 20:15
  • @leeand00 both if you want to cd to the directory. The POSIX permissions will supersede ACL's. So for your example if you want the extbk group to have read and execute access than the standard POSIX group should also have read and execute access. It's difficult to tell without seeing all of the permissions but I'm willing to bet if you set the permissions of the appdir2 directory to 750 and setfacl -m g:extbk:rw appdir2 it would work in the way you are expecting. – madflojo Jul 26 '15 at 21:07
2

There are two sets of FACL rules associated with folder ./appuser2: the FACL rules for folder ./appuser2 itself, and a second set of FACL rules that specify the default FACL rules that are applied to files and folders created within folder ./appuser2.

The steps you've outlined above set the "default" FACL rules that are applied to files and folders created within ./appuser2, but you have not defined a FACL rule set for the folder ./appuser2 itself. This is part of the reason why members of the group extbk cannot access ./appuser2 and its contents.

Another misconfiguration issue that requires correction is this: any user who requires access to folder ./appuser2 must be granted execute 'x' permission on that directory. As stated in the chmod(1) manual, for folders, the execute 'x' permission grants a user search permissions on the folder--i.e., the user is granted permission to execute a change directory action into the folder to access the folder's contents.

Here's an example based on your original comments for you to consider:

Listing 1: FACL permissions example

sudo su -
mkdir -p /opt/appdir2/{appuser1,appuser2}
setfacl -bR /opt/appdir2/
chmod 750 /opt/appdir2/appuser2/
find /opt/appdir2/ -ls
    1049001    4 drwxr-xr-x   4 root     root         4096 Jul 26 22:02 /opt/appdir2/
    1049051    4 drwxr-xr-x   2 root     root         4096 Jul 26 22:02 /opt/appdir2/appuser1
    1049053    4 drwxr-x---   2 root     root         4096 Jul 26 22:02 /opt/appdir2/appuser2

getfacl -p /opt/appdir2/appuser2/
    # file: /opt/appdir2/appuser2/
    # owner: root
    # group: root
    user::rwx
    group::r-x
    other::---

#==========================================================
# FACL rules for folder `/opt/appdir2/appuser2/'.

setfacl -m g:extbk:r-x /opt/appdir2/appuser2/

getfacl -p /opt/appdir2/appuser2/
    # file: /opt/appdir2/appuser2/
    # owner: root
    # group: root
    user::rwx
    group::r-x
    group:extbk:r-x
    mask::r-x
    other::---

#==========================================================
# FACL rules for files and folders created
# within folder `/opt/appdir2/appuser2/'.

setfacl -dm g:extbk:r-x /opt/appdir2/appuser2/

getfacl -p /opt/appdir2/appuser2/
    # file: /opt/appdir2/appuser2/
    # owner: root
    # group: root
    user::rwx
    group::r-x
    group:extbk:r-x
    mask::r-x
    other::---
    default:user::rwx
    default:group::r-x
    default:group:extbk:r-x
    default:mask::r-x
    default:other::---

echo "Hello" >/opt/appdir2/file1
echo "World" >/opt/appdir2/appuser2/file2

find /opt/appdir2/ -ls
    1049001    4 drwxr-xr-x   4 root     root         4096 Jul 26 22:13 /opt/appdir2/
    1049051    4 drwxr-xr-x   2 root     root         4096 Jul 26 22:02 /opt/appdir2/appuser1
    1049053    8 drwxr-x---   2 root     root         4096 Jul 26 22:13 /opt/appdir2/appuser2
    1049071    4 -rw-r-----   1 root     root            6 Jul 26 22:13 /opt/appdir2/appuser2/file2
    1049055    4 -rw-r--r--   1 root     root            6 Jul 26 22:13 /opt/appdir2/file1

getfacl -p /opt/appdir2/appuser2/file2
    # file: /opt/appdir2/appuser2/file2
    # owner: root
    # group: root
    user::rw-
    group::r-x                      #effective:r--
    group:extbk:r-x                 #effective:r--
    mask::r--
    other::---


#==========================================================
# Ensure users who are members of the group `extbk'
# are granted access to folder /opt/appdir2/appuser2/ 
# and its contents.

usermod -a -G extbk deleteme
su - deleteme

[deleteme]$ find /opt/appdir2/ -ls
    1049001    4 drwxr-xr-x   4 root     root         4096 Jul 26 22:13 /opt/appdir2/
    1049051    4 drwxr-xr-x   2 root     root         4096 Jul 26 22:02 /opt/appdir2/appuser1
    1049053    8 drwxr-x---   2 root     root         4096 Jul 26 22:13 /opt/appdir2/appuser2
    1049071    4 -rw-r-----   1 root     root            6 Jul 26 22:13 /opt/appdir2/appuser2/file2
    1049055    4 -rw-r--r--   1 root     root            6 Jul 26 22:13 /opt/appdir2/file1

[deleteme]$ cat /opt/appdir2/appuser2/file2
    World

[deleteme]$ exit

#==========================================================
# Ensure users who are NOT members of the group `extbk'
# are denied access to folder /opt/appdir2/appuser2/ 
# and its contents.

gpasswd -d deleteme extbk
su - deleteme

[deleteme]$ find /opt/appdir2/ -ls
    1049001    4 drwxr-xr-x   4 root     root         4096 Jul 26 22:13 /opt/appdir2/
    1049051    4 drwxr-xr-x   2 root     root         4096 Jul 26 22:02 /opt/appdir2/appuser1
    1049053    8 drwxr-x---   2 root     root         4096 Jul 26 22:13 /opt/appdir2/appuser2
    find: '/opt/appdir2/appuser2': Permission denied
    1049055    4 -rw-r--r--   1 root     root            6 Jul 26 22:13 /opt/appdir2/file1

[deleteme]$ cat /opt/appdir2/appuser2/file2
    cat: /opt/appdir2/appuser2/file2: Permission denied

[deleteme]$ exit
  • What does facl stand for? – leeand00 Jul 27 '15 at 11:40
  • I know acl stands for Access Control List, but what is the F for? – leeand00 Jul 27 '15 at 12:13
  • 1
    FACL := File Access Control List (a.k.a., Access Control List). The SETFACL(1) manual summarises the setfacl command's functionality as "sets file access control lists", so years ago I got into the (bad?) habit of saying FACL instead of ACL. – Jim Fischer Jul 27 '15 at 21:23
  • No I don't think that's bad, I think it makes sense, because there are acls in networking too...nacls I guess they could call'm. – leeand00 Jul 27 '15 at 21:47
  • Alright it worked, thank you. But I noticed that my distro (Ubuntu, probably not considered real Linux) sets the other permission to r by default. – leeand00 Jul 27 '15 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.