0

I need to give full access to user1 and user2 to this directory:

drwxr-xr-- 3 oracle dba   4096 feb  9 23:16 scripts

I can't change directoy group because probably that group is needed for other users to access the directory and I can't add user1 and user2 to dba group because in this case I will give too much privileges to these users.

I know I can use ACLs but, are ACLs a good practice? I think that using ACLs introduce a lot of chaos and you lose the control.

Another thing I have though is to create a new group and add all users in dba group to this new group and then change directory group to this new group, would this guarantee that all users that had access to this directory will continue to have access?

What would be the best practice to give these two users full access to this directory without removing permissions from other already existent users?

|improve this question
  • I think not using ACL leads to chaos, but this is Unix - poorly designed ACL subsystem today leads to multiplied chaos in future – user140866 Feb 13 '16 at 7:59
1

I think that using ACLs introduce a lot of chaos and you lose the control.

I don't think so. (I'm backing up my statement with as much evidence as you did yours.)

If you have a problem that calls for ACLs, use ACLs.

Here, the key question is: if a new user is added to the dba group, will they need to get access to the scripts directory?

  • If the answer is yes, then the set of users who should have access to scripts should mention the dba group by reference. Hence the directory should have an ACL that allows access to the dba group as well as to the users user1 and user2. It would probably be cleaner to define a second group of “DB scripters” containing user1 and user2, and setting an ACL on scripts that allows access to the “DB scripters” group.
  • If the answer is no, then the set of users who should have access to scripts is not related to the dba group. In this case you should create a “DB scripters” group that contains user1 and user2 as well as all the current DBAs (but not the future DBAs who shouldn't have access to that file).

In this scenario, it's likely that the answer is yes and therefore ACLs are exactly the right tool for the job.

Changing the ACL on a file takes effect immediately, just like traditional permissions. Adding a user to a group takes effect the next time they log in.

|improve this answer
  • I think that ACLs are out of the standard and I think they introduce chaos because if you ls the contents of a directory of 10 files, you have to see the ACLs of the 10 files in order to have an idea of who has access to what. Using owners and groups seems more clean and correct to me but obviously I may be wrong. In the other hand, you said that ACLs do not introduce chaos but I don't see in your answer how to control the granularity ACLs introduce, any hint? – Eloy Roldán Paredes Feb 15 '16 at 7:28
  • 1
    @EloyRoldánParedes What do you mean by “control the granularity ACLs introduce”? Having granularity in access permissions is the point of ACLs. It's true that ACLs make the permissions potentially more complex, but if you don't like that, it isn't enough to refrain from using them, you should disable them altogether. The cost of having ACLs is well offset by being able to solve problems such as yours however: having ACLs is a lot simpler than maintaining a truckload of related groups, and has less attack surface since it doesn't involve root all the time. – Gilles Feb 15 '16 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.