1

One of the study questions I'm doing is suggesting that I apply ACL's for the /root directory recursively for a regular user on the system. Obviously, this is bad security practice but it's just for practice inside a VM and I will remove the ACL once I'm done.

I've tried like this:

setfacl -R -m u:username:rwx /root

But when I log in as username I just get every file as rwx permissions, including text files and other non executables.

Is there a neater way that copies permissions into the ACL from regular ugo permissions, or would that involve a bit of bash scripting?

3
  • 1
    you want to add the permission just to folders not files ? Is that the case?
    – vfbsilva
    May 4, 2017 at 20:45
  • I think for the purposes of learning I just want to mirror the privileges that the root user would have on the /root directory but using ACL to make it available to the average user. Would that be accomplished just by adding directories and not files? I will try...
    – bitofagoob
    May 4, 2017 at 20:58
  • Oh. Whaddya know! I tried just this: setfacl -m u:username:rwx /root and it seems to have worked. It was simpler than I imagined!
    – bitofagoob
    May 4, 2017 at 21:03

1 Answer 1

2

I found that it wasn't necessary to use the recursive (-R) switch in this case.

Just doing this:

setfacl -m u:username:rwx /root

Was enough to give me execute access to /root as normal user and also tried copying some executables into the directory and subdirectories. They ran just as if I were accessing my home directory.

Thanks to vfbsilva for the reply, which made me try the simpler approach. I have upvoted their comment.

2
  • please add here theexplanation of the -m trigger so we can actualy undestand why it did not work on first place
    – vfbsilva
    May 4, 2017 at 21:13
  • 1
    The -m switch just tells it to modify an ACL. If only the default ACL template exists for a file the -m switch just modifies the default ACL.
    – bitofagoob
    May 4, 2017 at 22:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .