1

I'm trying to use ACLs with the xfs file system on Amazon Linux (RHEL-ish distribution). However, when I configure acls and try to access a file with a test user, my access is denied.

I currently have 2 users:

ec2-user: User to create and manage file. Owner and full rwx access

testuser: Access explicitly given via acl

Questions:

- My current understanding with xfs is that acls work 'out of the box'. Unliked ext3/ext4, I don't need enable this option at mount. Is this correct?

- Below is a code snippet of how I'm creating and permissioning the file. Is this a correct implementation of acls?

# Create directory and add file
sudo mkdir /aclDirectory
sudo echo "some content" | sudo tee /aclDirectory/test.txt

# Change owner to EC2 user and give RW access to 'testuser'
sudo chown -R  ec2-user /aclDirectory/
chmod -R 0700 /aclDirectory/
setfacl -R -m  u::testuser:rw /aclDirectory

# validate ACL permissions
getfacl /aclDirectory/test.txt

getfacl: Removing leading '/' from absolute path names
# file: aclDirectory/test.txt
# owner: ec2-user
# group: root
user::rwx
user:testuser:rw-
group::---
mask::rw-
other::---

# Read test.txt
cat /aclDirectory/test.txt 
cat: /aclDirectory/test.txt: Permission denied

1 Answer 1

0

The Extended and XFS filesystems use the ACL option automatically now. The user, testuser, still needs execute permission to see files in /aclDirectory. You'll need an ACL for the directory itself and an ACL for all new filesystem objects created in the directory.

# Remove the ACLs.
sudo setfacl -b /aclDirectory

# Create the default ACL (for filesystem objects created within the directory).
sudo setfacl -d -m u:testuser:rwx /aclDirectory

# Set an ACL for the directory itself.
sudo setfacl -m u:testuser:rwx /aclDirectory

Then create a test file as ec2-user for testuser.

1
  • Thank you! I didn't understand how the default setting worked and just assumed it would automatically propagate down from the parent directory. Good to know and thanks for your help
    – slidmac07
    Commented Nov 26, 2018 at 17:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .