2

There's a file called '/etc/file.conf' on my filesystem.

$ getfacl /etc/file.conf
getfacl: Removing leading '/' from absolute path names
# file: etc/file.conf
# owner: root
# group: root
user::rw-
group::r--
other::r--

I want the my account 'userr' to have write permissions so my Python script can write to it. It's owned by root so my idea was to create a new group and setfacl that to it.

$ sudo groupadd rsnap
$ sudo usermod -a -G rsnap userr
$ id userr
uid=1000(userr) gid=1000(userr) groups=1000(user),27(sudo),1001(rsnap)
$ sudo setfacl -m g:rsnap:rw /etc/file.conf

$ getfacl /etc/file.conf
getfacl: Removing leading '/' from absolute path names
# file: etc/file.conf
# owner: root
# group: root
user::rw-
group::r--
group:rsnap:rw-
mask::rw-
other::r--

However..

$ echo "Test" >> /etc/file.conf
-bash: /etc/file.conf: Permission denied

What have I missed?

3
  • Did you check that your user is in the correct group (run "groups")?
    – cristi
    Nov 6 '15 at 12:52
  • Did you log out and log back in after changing the group membership? Nov 6 '15 at 13:18
  • Groups shows I'm in rsnap, even after relogging.
    – user115039
    Nov 6 '15 at 13:56
0

You modified /etc/rsnapshot.confbut you tested with /etc/file.conf.

You still need to enable the mask via:

setfacl -m m:rw- filename

or

setfacl -m m::rw- filename

depending on the OS - note that this kind of ACLs was never standardized. A related standard proposal from 1993 was withdrawn in 1997.

BTW: I just notice that your mask may have been set already. So you still used the wrong filename.

Problems in this outdated ACL propsal will occur frequently as the standard proposal was never finished and as there was an aggreement that it is not what cutomers like to have.

3
  • Oops, I was just replacing rsnapshot.conf with file.conf in this post to make it easier for everyone! However, setting the first mask made it work perfectly! Could you explain how that made such a difference?
    – user115039
    Nov 6 '15 at 13:55
  • This was discussed in the USENET around 1995. Before, this withdrawn ACL proposal did not implement the mask at all and this caused a lot of confusion with what people expected as behavior. But these old ACLs allow you to set alternate owners and alternate groups for a file and the mask allows to control the way the lists are evaluated in the kernel for verifying access rights.
    – schily
    Nov 6 '15 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy