2

I have read a bunch of articles, but still cannot get an idea of ACL, so I have following questions.

  1. What are benefits of using ACL over old permissions (0777 for example) and changing file owner, group etc ? (Only one for me as I guess is multiple user can have different permission for one file)
  2. How ACL is implemented ? Does it use inode data ?
  3. Is there any connection between extended attributes(xattr) ?
  4. Does VFS have support for extended attributes ? Or this is FS specific` feature ?

Please help to understand this, maybe there some good articles about this ?
Thanks

3

ACLs allow more than one person and more than one group to be granted permissions. For example, you might have an SA team and a DBA team. You want to grant SAs "read+write" access to a file, but the DBAs only read access. Since a file can only have one group owner this is hard to do. But with ACLs it is easy.

ACL implementations are filesystem specific. Typically they are associated with inodes. e.g.

$ echo test > file
$ setfacl -m g:dbus:rw file
$ getfacl file 
# file: file
# owner: sweh
# group: sweh
user::rw-
group::r--
group:dbus:rw-
mask::rw-
other::r--

Here we can see there are two group permissions set on the file, with different permissions.

Let's make a hardlink between the files (different filenames, same inode) and see the results:

$ ln file file2
$ getfacl file2
# file: file2
# owner: sweh
# group: sweh
user::rw-
group::r--
group:dbus:rw-
mask::rw-
other::r--

So we make a hard-link between the files, and the ACLs are available on the new filename, indicating they are associated with the inode and not the filename.

ACLs are different to extended attributes, but they may be stored in xattr name spaces. xattr attributes are filesystem dependent.

  • 1
    It's also work mentioning that implementations like richacls allow for more operations to be specified than exist in tradional POSIX permissions. POSIX ACL's just extend traditional permissions to multiple users/groups whereas richacls extend NFS ACL's to local filesystems. – Bratchley Jun 17 '16 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.