3

I am just learning about Rich Access Control Lists on Linux. My immediate objective is to give members of the group the same rights as the owner for a subdirectory tree (all files and directories within).

I have reviewed the man pages for setfattr and getfattr. Neither of those man pages provide a list of the available RichACL's. (I'm really only interested in the RichACL's that are compatible with BTRFS.)

This is another good resource richacl: Rich Access Control Lists - Linux Man Pages (7) that provided some background.

I have done simple examples such as:

setfattr -n user.comment -v "this is a comment" test.txt

Followed by:

getfattr test.txt

I know that these operations are different from setfacl and getfacl.

I also understand there are four namespaces of extended file attributes:

  • user
  • trusted
  • security
  • system

And I know that RichACL's are richer than POSIX ACL's. And ACLs are different from extended attributes (but they may be stored in xattr name spaces). I know the specifics of what I'm trying to do are filesystem dependent, and that's OK. I only care about BTRFS.

However, I don't have enough information to be able to do anything useful yet. As mentioned, the first thing I want to do is to give the group all the same rights as the owner of a file or directory. Then I want to have those inherited to subdirectories and files in those directories.

Some specific examples include: I want the group members to be able to do operations like chmod, chatttr or even chown, if I deem that to be appropriate.

EDIT: as part of your answer, please also address the utilities (programs) used to read and set rich acl's. I have seen setfattr used in connection with rich acl's. However, I have also seen reference to a utility named setrichacl but I do not find such a utility in Arch Linux.

Stock kernel config info for ACL's:

$ zcat /proc/config.gz | grep -i acl
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_REISERFS_FS_POSIX_ACL=y
CONFIG_JFS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_F2FS_FS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_JFFS2_FS_POSIX_ACL=y
CONFIG_EROFS_FS_POSIX_ACL=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFSD_V2_ACL=y
CONFIG_NFSD_V3_ACL=y
CONFIG_NFS_ACL_SUPPORT=m
CONFIG_CEPH_FS_POSIX_ACL=y
CONFIG_9P_FS_POSIX_ACL=y
2

It turns out that Rich ACL's are not supported by the mainline Linux kernel.

Source: https://wiki.samba.org/index.php/NFS4_ACL_overview#Linux

Further, as of 2 May 2019:

Re: PATCH overlayfs: ignore empty NFSv4 ACLs in ext4 upperdir - Andreas Gruenbacher

The patches for implementing that have been rejected over and over again, and nobody is working on them anymore.

Thanks reddit user progandy for this info.

1
  • You are correct, the common name is NFSv4 ACLs or ACEs (extended ACLs). The concept is from NTFS but it has first been standardized with NFSv4 20 years ago. Since these ACEs are an integral part os NFSv4, it is unfortunate that Linux does not yet implement full NFSV4 support. BTW: this is an area where Linux typically is extremely slow in the rollout. The main UNIX variants support ACEs since 15 years. – schily Feb 1 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.