Access control lists and permission on directory

Question

So I have a script infinite.sh that is in the /root directory.

I want to give the user Bob permission to run this script.

So what I did is that

setfacl -m u:Bob:rwx infinite.sh

and

setfacl -m d:Bob:rwx /root

However, when I switch to the user Bob, I still can't even cd into the /root directory of run the infinite script -- that doesn't make sense to me.

Answer 1

The line

setfacl -m d:Bob:rwx /root

will set a "default" for new directories created inside /root but doesn't change that directory itself.

You may have meant

setfacl -m u:Bob:rwx /root

Note that this is insecure; Bob can now modify files (eg mv .profile .profile.old and create a new .profile) to gain full root access.

Better might be

setfacl -m d:Bob:rx /root

so Bob can read stuff but not change it.

Similarly:

setfacl -m u:Bob:rx infinite.sh