We are having user1 and user2 in AIX server (7100-04-05) and we need to give readonly access to path /data/web/tmp/* (they need to be able to read contents of files). With AIXC access list we can give access to path and the files that already exist in the directory.

Issue is that we need to make the Access list to be applied to newly generated files/directories.

Any hints who the default generated ACL be achived?

Currently the ACL of /data/web/tmp/

* ACL_type   AIXC
base permissions
    owner(appuser):  rwx
    group(appgroup):  r-x
    others:  r-x
extended permissions
    permit   r-x     u:user1
    permit   r-x     u:user2

The usual way to solve this on any Unix system, even without ACLs, is to create a new group, make user1 and user2 members of this group, and adjust the group permissons of /data/web/tmp accordingly (r-x).

With sticky group bits (not sure if they exist under AIX) one can then make sure that newly created files and directories under this directory always inherit the correct group.

(For Unix-style permission management, it's important to think of "group" as "one set of permission rules", not "one group of users according to company/institute hierarchy").

Is there any reason you have to use ACLs, and can't use this standard approach?

  • currently the path owned by appuser:appgroup. by adding users to a new group we still have to make modifications. we dont want to change the group of the files nor the user1 or user2 get access to the appgroup. – igiannak Nov 15 '18 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.