1

I'm trying to use ACLs with the xfs file system on Amazon Linux (RHEL-ish distribution). However, when I configure acls and try to access a file with a test user, my access is denied.

I currently have 2 users:

ec2-user: User to create and manage file. Owner and full rwx access

testuser: Access explicitly given via acl

Questions:

- My current understanding with xfs is that acls work 'out of the box'. Unliked ext3/ext4, I don't need enable this option at mount. Is this correct?

- Below is a code snippet of how I'm creating and permissioning the file. Is this a correct implementation of acls?

# Create directory and add file
sudo mkdir /aclDirectory
sudo echo "some content" | sudo tee /aclDirectory/test.txt

# Change owner to EC2 user and give RW access to 'testuser'
sudo chown -R  ec2-user /aclDirectory/
chmod -R 0700 /aclDirectory/
setfacl -R -m  u::testuser:rw /aclDirectory

# validate ACL permissions
getfacl /aclDirectory/test.txt

getfacl: Removing leading '/' from absolute path names
# file: aclDirectory/test.txt
# owner: ec2-user
# group: root
user::rwx
user:testuser:rw-
group::---
mask::rw-
other::---

# Read test.txt
cat /aclDirectory/test.txt 
cat: /aclDirectory/test.txt: Permission denied
0

The Extended and XFS filesystems use the ACL option automatically now. The user, testuser, still needs execute permission to see files in /aclDirectory. You'll need an ACL for the directory itself and an ACL for all new filesystem objects created in the directory.

# Remove the ACLs.
sudo setfacl -b /aclDirectory

# Create the default ACL (for filesystem objects created within the directory).
sudo setfacl -d -m u:testuser:rwx /aclDirectory

# Set an ACL for the directory itself.
sudo setfacl -m u:testuser:rwx /aclDirectory

Then create a test file as ec2-user for testuser.

  • Thank you! I didn't understand how the default setting worked and just assumed it would automatically propagate down from the parent directory. Good to know and thanks for your help – slidmac07 Nov 26 '18 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.