I've looked at other answers but can't find an answer for this.

I have a file system which uses ACLs. I want to test what the resulting set of permissions (both traditional and ACLs) will be for a given user (or group, I guess) if they try to access a file nested within the file tree.

(Note - I'm not asking "can they access it" or "can they change it". I'm looking for output which tells me the complete human readable set of effective rights that that user would have, which could vary from none at all, to some rights but not others, to full rights.)

man getfacl doesn't say how to do this, but it's so basic I must be missing something.

  • getfacl takes into account the standard unix permissions (indeed setfacl will update them as necessary). But it's not the whole story, because the permissions on the directory path may impact things. If you want to know if a given user can access a file then a setuid program that sets uid to the user you want to test and then calls access(2) may be the way to go. – Stephen Harris Feb 18 '18 at 0:45
  • 1
    That's exactly what prompted the question. I know that I can setuid to the user and test some flags - and it's inefficient (have to switch user to do it), incomplete (less easy to identify some ACLs if others are DENYed), and even if one can read all relevant ACLs in its dir path (hence is allowed to calculate the user's effective ACLs "the long way around") you might not have the ability to setuid to the user. Final nail in coffin: access doesnt seem to return ACLs anyway. I appreciate the comment but it doesn't seem to get closer to an answer.. – Stilez Feb 18 '18 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.