Questions tagged [acl]

ACL stands for access control list. ACLs extend permissions on files beyond the traditional user-group-others triple.

125
votes
3answers
181k views

Make all new files in a directory accessible to a group

Suppose I have two users A and B and a group G and a folder foo, both users are members of G (using linux and ext3). If I save as user A a file under foo, the permissions are: -rw-r--r-- A A. ...
36
votes
5answers
138k views

How to determine if NFS mount is mounted as v3 or v4?

Red Hat 5/6 when I do mount it says type nfs, I would like to know how to determine version if it isn't listed in mount options or fstab. Please don't say remount it with the version option, I want ...
23
votes
3answers
86k views

How do I set permissions recursively on a dir (with ACL enabled)?

For example, I want to give my colleagues write access to certain directory. Let's assume that subdirectories in it had access rights 775, files 664, and also there were some executable files in the ...
23
votes
7answers
20k views

What to use to backup files, preserving ACLs?

When using the tar utility to store files in backups one loses the extended ACLs. Is there some commonly used and not hackish solution (like: create a script that will recrate the ACLs from scratch) ...
23
votes
2answers
58k views

How to remove ACL from a directory and back to usual access control?

We use a hosting server of FreeBSD 10.3, where we don't have the authority to be a superuser. We use the server to run apache2 for web pages of our company. The previous administrator of our web pages ...
21
votes
1answer
6k views

How are ACL permissions processed and in what order do they apply to a given user action?

CentOS 6.4 I'm trying to better understand how filesystem ACL rules are processed and in what order ACL rules apply. For example, let's say users bob and joe belong to a group called sales. Let's ...
18
votes
4answers
10k views

Precedence of user and group owner in file permissions

I just ran into something unexpected (for me) regarding file permissions on Linux (Arch Linux). Basically I have: userX in groupX fileX userX:groupX ---rwx---- What puzzles me: I cannot perform any ...
16
votes
3answers
12k views

What roles do DAC (file permissions), ACL and MAC (SELinux) play in Linux file security?

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security. After some research from the documentation, this is my understanding of the ...
16
votes
2answers
10k views

Allow owner to create & read files, but not modify or delete

I would like to give a user permissions to create and read files in a particular directory, but not to modify or delete files. If the user can append to files that is ok, but I'd rather not. This is ...
15
votes
2answers
13k views

What relationships tie ACL mask and standard group permission on a file?

At first I create a file and check it's standard permissions and ACL entries: $ touch file; ls -l file; getfacl file -rw-r--r-- 1 user user 0 Jul 30 16:26 file # file: file # owner: user # group: ...
15
votes
3answers
5k views

Is there a Linux deep diff tool that also compares file attributes?

Is there a Linux tool like diff that will recursively compare files and directories, but with the addition of also comparing: extended attributes, acl's, se contexts?
13
votes
3answers
13k views

Back up and restore file permissions

Is there a way to back up and restore file ownership and permissions (the things that can be changed with chown and chmod)? You can do this in Windows using icacls. What about access control lists?
10
votes
4answers
40k views

Setting default username and group for files in directory

Using this helpful post I am able to set a default group and file permissions in a folder. I'm having trouble setting a default owner (teamlead uid 1234). setfacl -d -m g::rwx /my/test/folder ...
10
votes
2answers
15k views

How does umask affect ACLs?

Can someone explain to me how umask affects the default mask of newly created files if ACLs are activated? Is there some documentation about this? Example: $ mkdir test_dir && cd test_dir $ ...
10
votes
3answers
12k views

How do I know ACLs are supported on my file system?

Is it enough to see getfacl giving no error, or do I have to check some other place to see whether or not ACLs are supported by the file systems?
10
votes
2answers
15k views

Using setfacl to allow group members to write to any file in a directory

I'd like to use setfacl so that anyone in group 'app' can edit any file contained within /usr/local/users/app regardless of what the traditional UNIX permissions say. I have two users john and ben. I ...
10
votes
1answer
3k views

Why does getfacl remove the leading / from absolute pathnames?

I'm in the midst of learning about ACL's for CentOS/Red Hat 6; when I run getfacl using an absolute path, I get among the output: getfacl: Removing leading '/' from absolute path names Why does ...
10
votes
1answer
170 views

Why did FreeBSD lose the w mask but Debian retained it?

I am trying to understand the difference in behaviour between FreeBSD ACLs and Linux ACLs. In particular, the inheritance mechanism for the default ACLs. I used the following on both Debian 9.6 and ...
9
votes
2answers
10k views

Difference between chmod vs ACL

I understand chmod and chown and how the permission bits work, but there is another permission system inside Linux, ACL with setfacl and getfacl, so this makes me wonder. What's the difference ...
9
votes
1answer
1k views

Using ACLs over read only/remote filesystem

I would like to define local ACLs to be used over a remotely mounted filesystem. The filesystem is mounted via autofs and sshfs FUSE. The idea is that we could set up a jailed user on a jump server ...
8
votes
1answer
20k views

setfacl: Are these two commands the same?

I have a deployment script (based on capifony) that sets te permissions on specific servers for a Symfony2 installation. It contains the following two commands to do this for several directories: ...
8
votes
1answer
170 views

Why was POSIX.1e withdrawn?

The proposed POSIX.1e standard defines a few things like ACLs that are widely supported. But the proposal itself was withdrawn. How come? The only reasoning I've found online is this quote from ...
7
votes
4answers
1k views

facl ignoring the “x” permission but only on files

When I use setfacl to manage on what permissions should the children files / directories have, for some reason the files have all the permissions except the execute ("x") one. someuser@someuser-MS-...
7
votes
1answer
3k views

How can I use setfacl to give no access to “other” users?

The command setfacl -dm g::rwx mydir sets permissions for groups to read-write-execute. I'd like to run a similar command such that other users (i.e. not the owner) have no access whatsoever, but ...
7
votes
1answer
7k views

Using setfacl to create recursive permissions for Apache with rsync

I have a Dokuwiki installation locally, which I regularly sync to my server with rsync. I'm also going to give a friend of mine an ssh account, and host his public Dokuwiki installation. However, I'm ...
6
votes
5answers
22k views

Howto set access control lists ACLs in OpenLDAP

I'm using the Debian Squeeze OpenLDAP. Where can I set ACLs? Isn't it possible to execute the access to directives with ldapmodify? There's no slapd.conf file in Debian, they use a slapd.d folder
6
votes
2answers
13k views

How does ACL calculate the effective permissions on a file?

I ran the following command to give the wheel group rwx permissions on new files and subdirectories created: [belmin@server1]$ ls -la total 24 drwxr-sr-x+ 2 guards guards 4096 Aug 27 15:30 . drwxr-...
6
votes
3answers
5k views

Where is ACL data technically stored?

I'm studying ACLs and am confused on where this information technically resides. Is this just technically just meta data from inodes?
6
votes
1answer
368 views

Can not explain ACL behavior

So this is situation: got server for web-developers. There are many developers. All developers + PHP + Apache belongs to www group. There is a development directory - development. The goal is that ...
6
votes
1answer
4k views

How do I edit a file and preserve its access control list / SELinux security context?

I'm on CentOS 6.2, and have a file with the alternate access method character displayed as a dot. ls -l myfile -rwxr-x---. 1 me mygroup 172 Aug 13 10:03 myfile ^ This dot. ...
6
votes
1answer
665 views

How to Run Tunefs on Root Filesystem in FreeBSD?

I want to enable ACLs for a FreeBSD 11 system. According to the FreeBSD Handbook this can be done in two ways: By using a mount option -- mount -o acls By modifying a superblock -- tunefs -a enable ...
6
votes
1answer
179 views

group member unable to write to a group-writable file with reiserfs and extended ACLs

Users vi and rust share group rust and want to use some file in shared manner. rust$ ls -l myfile -rw-rw-r-- 1 vi rust 0 May 30 03:48 myfile rust$ stat myfile | grep Gid Access: (0664/-rw-rw-r--) ...
5
votes
1answer
7k views

ACL is NOT enabled but it's working [duplicate]

How this is possible? ACL is not enabled in /etc/fstab, and I can verify it via manually opening fstab or running sudo mount | grep -i acl. But getfacl & setfacl Commands would work without any ...
5
votes
3answers
9k views

Set sticky bit by default for new directories via ACL?

I want to set up a directory where all new files and directories have a certain access mask and also the directories have the sticky bit set (the t one, which restricts deletion of files inside those ...
5
votes
1answer
5k views

ACL, ls, “permission denied” and a lot of questionmarks

I have two users, Alice and Bob. Bob should be allowed to list, ls, Alice's home directory. Alice also has a file in her home directory that Bob should also be allowed to read. I run these commands ...
5
votes
1answer
508 views

Equivalent of subinacl.exe on linux / unix?

When modifying permissions on Windows I backup the ACLs to a file first using a commands like: subinacl /noverbose /output=C:\temp\foldername_redir_permissions_backup_star_star.txt /subdirectories "...
5
votes
1answer
431 views

How can I make ACL settings on /run/media/* persistent?

I have various virtual machines running as guests on a Fedora 25 Workstation host. I store virtual disks (and all other personal stuff) on different separate partitions on a second built-in disk. virt-...
5
votes
1answer
2k views

Precedence of ACLS when a user belongs to multiple groups

If a file has ACL entries for two groups, giving them different permissions, like this: group:admin:rw- group:staff:r-- what permissions does a user have if he belongs to both groups? Which entry ...
5
votes
1answer
2k views

Can ACLs override file perms on Linux?

I struggled with this problem on FreeBSD recently, but thank God for ZFS which solved it for me there. However I have it again in CentOS with ext4 and don't know if there is an easy way around it (or ...
5
votes
1answer
2k views

Using ACL with Multiple Default Groups

I have looked though the answers to similar questions and refreshed my memory on ACLs by reading tutorials on Linux ACLs. Yet, I am still stumped. What have I done wrong, or what do I not understand? ...
5
votes
1answer
7k views

setfacl default --x on directories and r— on files for user

Having the following directory structure [sr@server directory]$ tree . ├── folder1 │   ├── fileA │   └── fileB └── folder2 └── fileC 2 directories, 3 files I want to set a default facl on ...
5
votes
1answer
830 views

ACL mask does not work as expected

If I copy a file with a base ACL of: u::rw-,g::r--,o::r-- into a directory with a default ACL of: u::rwx,g::r-x,g:users:rwx,m::rwx,o::r-x I obtain a file with mask of m::r--. I would have expected ...
5
votes
1answer
2k views

Who can change ACL permissions?

I'm using ACL to control access to individual roots of webs for different instances of Apache and different groups of admins. I've got a Unix group admins-web22 for admins of a particular website and ...
5
votes
1answer
148 views

Setting group permission on directory

I'm looking for the best way to give a group permission to view any files in /var/log, but only using cat or tail. My best guess right now is that I need to use ACL's: setfacl -mR default:g:group:4 /...
5
votes
2answers
1k views

Mercurial (hg) not respecting default ACL settings

I'm trying to set fine grained access control to various mercurial repositories using ACL. When I push changes to repository any new files created under /myrepo/.hg/store/data do not have default ...
5
votes
1answer
807 views

How do I recursively apply default ACLs of a directory to its descendants?

If I have a directory with default ACL entries assigned to it, but some or all of its descendant files and sub-directories have access or default ACLs that do not agree with those defaults, how do I ...
5
votes
1answer
506 views

Why does default setfacl fail for nested directories?

I am using sftp with the internal-sftp for debian. What I'm trying to acomplish is to jail all users to a specific folder which is working fine. I also need to have a single user that has "admin" ...
4
votes
2answers
901 views

Unix/Linux equivalent of Windows' Bypass Traverse Checking

Windows has a privilege called "Bypass Traverse Checking" (also known as SeChangeNotifyPrivilege). It allows the system to bypass ACL checks in parent objects so a user can [potentially] access a ...
4
votes
2answers
3k views

How do I create a hierarchy of UNIX groups as below?

I need to create a hierarchy of UNIX groups. Something like below: A |\ | \ B c |\ D e |\ f g ...where A, B and D are UNIX groups and c,e,f and g are UNIX accounts that are members of those ...
4
votes
2answers
3k views

setfacl incorrectly changes group permissions

To backup the "/home" directory tree of a server, I've created a 'backup' account and used setfacl to make the whole directory readable by it. My cron job runs this command as root each night: ...