Hot answers tagged

46

Here are 2 ways to do it: mount Using mount's -v switch: $ mount -v | grep /home/sam mulder:/export/raid1/home/sam on /home/sam type nfs (rw,intr,tcp,nfsvers=3,rsize=16384,wsize=16384,addr=192.168.1.1) nfsstat Using nfsstat -m: $ nfsstat -m | grep -A 1 /home/sam /home/sam from mulder:/export/raid1/home/sam Flags: rw,vers=3,rsize=16384,wsize=16384,hard,...


39

setfacl has a recursive option (-R) just like chmod: -R, --recursive Apply operations to all files and directories recursively. This option cannot be mixed with `--restore'. it also allows for the use of the capital-x X permission, which means: execute only if the file is a directory or already has execute permission for some user (X) ...


27

Use nfsstat -m it will display all the nfs mounted filesystem and theirs properties.


26

Our problem was resolved by using: setfacl -bn foobar The point was we also had to remove the aclMask from the directory with an option -n... The man page of setfacl says as follows: -n Do not recalculate the permissions associated with the ACL mask entry. This option is not applicable to NFSv4 ACLs. We're not sure why this option worked, ...


24

The thing is, I always thought these permissions collapse on each other, starting with the most general one (other -> group -> user). If it was the case then “other” permissions would apply to everyone. In other words, if o=rwx who cares what the persmissions for group and user are? That's different from your previous sentence. Here you're implying that ...


20

You can do this with the commands from the acl package (which should be available on all mainstream distributions, but might not be part of the base installation). They back up and restore ACL when ACL are present, but they also work for basic permissions even on systems that don't support ACL. To back up permissions in the current directory and its ...


18

When a process performs an operation to a file, the Linux kernel performs the check in the following order: Discretionary Access Control (DAC) or user dictated access control. This includes both classic UNIX style permission checks and POSIX Access Control Lists (ACL). Classical UNIX checks compare the current process UID and GID versus the UID and GID of ...


16

With setfacl you can set default permissions but not default owner/group for newly created files. To get new files to be owned by a specific user, you'd need a setuid bit that works like the setgid bit on directories. Unfortunately that is not implemented. With setfacl you can do something which is nearly equivalent in most scenarios: You can set an ACL ...


16

You could use bindfs like: $ ls -ld dir drwxr-xr-t 2 stephane stephane 4096 Aug 12 12:28 dir/ That directory is owned by stephane, with group stephane (stephane being its only member). Also note the t that prevents users from renaming or removing entries that they don't own. $ sudo bindfs -u root -p u=rwD,g=r,dg=rwx,o=rD dir dir We bindfs dir over itself ...


15

This is kind of a broad topic and a little too much to cover here. I'll refer you to the POSIX Access Control Lists on Linux whitepaper put together by Andreas Grünbacher of the SuSE Labs. It does a pretty good job of covering the subject and breaking it down so you understand how ACLs work. Your example Now let's take a look at your example and break it ...


14

The first command will change the permissions of any pre-existing files/directories. The -d in the second command is critical to setting the default permissions going forward for any directories, which in turn will provide a default set of ACLs for any files within these directories. NOTE: That in both instances the commands will run recursively via the -R ...


14

ext3/4 file systems have a default mount options attribute in their headers. You can see it with: $ LC_ALL=C tune2fs -l /dev/device | grep 'Default mount options:' Default mount options: user_xattr acl You can change it with tune2fs -o and mounting with -o noacl would override it. When creating a new file system, mke2fs will set that based on what you ...


11

It doesn't make sense if the unix file permissions disagree to the acl entry and vice versa. Accordingly, the manual page (acl(5)) says what you ask for: CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS The permissions defined by ACLs are a superset of the permissions specified by the file permission bits. There is a correspondence ...


10

I found this example, titled: ACL and MASK in linux. In this article the following examples are demonstrated which I think help to understand how ACL's and umask interact with each other. Background When a file is created on a Linux system the default permissions 0666 are applied whereas when a directory is created the default permissions 0777 are applied. ...


10

A new file is always created belonging to the user that the process creating the file is running as. (The effective user ID, to be precise.) This cannot be changed, because allowing users to create files belonging to other users would be security hole, similar to allowing non-root users to give away a file. Whatever you're trying to do, you don't need to ...


10

An empty permission set can be represented with -: setfacl -dm o::- mydir This doesn't appear to be documented, so I don't know how portable it is. However, the documentation does mention that they can be specified as an octal digit (4 r, 2 w, 1 x, as in chmod), so: setfacl -dm o::0 mydir


9

From Debian Wiki: Since version 2.4.23-3 the configuration of OpenLDAP has been changed to /etc/ldap/slapd.d by default. So, OpenLDAP allow to configure itself dynamically through 'cn=config' tree. You can list DN in cn=config and see something like this: sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config dn ... # {1}hdb, config dn: olcDatabase={1}...


9

I'm looking for a solution as well so far I found this: first do a getfactl from my folder getfacl -R /a_folder > folder.acl then do a regular tar tar -czvf folder.tar.gz /a_folder when I extract it tar -xvf folder.tar.gz do a setfacl for the permissions. setfacl --restore=folder.acl this works for me.


9

The exact details may depend on the filesystem, but conceptually, yes, the ACLs are metadata stored in the file inodes just like traditional permissions, dates, etc. Since the size of ACLs can vary, they may end up being stored in separate blocks. However the details only matter if you're designing a filesystem or programming a filesystem driver.


9

The names getfacl and setfacl as in Tom Hale's answer are conventional and are derived from the original TRUSIX names getacl and setacl for these utilities. https://superuser.com/a/384500/38062 Craig Rubin (1989-08-18). Rationale for Selecting Access Control List Features for the Unix System. NCSC-TG-020-A. DIANE Publishing. ISBN 9780788105548. Portable ...


8

The /home/alice/ directory needs executable access for the user accessing it. EDIT: BTW, the question marks are there to indicate that ls can't get the permissions on the file.


8

Sure, to demonstrate, as root... touch /tmp/test setfacl -m u:jdoe:--- /tmp/test getfacl /tmp/test su - jdoe cat /tmp/test exit rm /tmp/test It could be done to every file in a directory by default as well: mkdir /var/data/not-for-jdoe setfacl -m u:jdoe:--- /var/data/not-for-jdoe setfacl -d -m u:jdoe:--- /var/data/not-for-jdoe Above, the -m switch is the ...


8

The ext4 code in older kernels (I do not know until when) needs acl as mount option. So you may try: mount -o remount,acl / /etc/fstab Your fstab contains a line like /dev/sda3 / ext4 defaults 0 0 You have to add acl to the options field: /dev/sda3 / ext4 defaults,acl 0 0


7

You'll notice the "effective" comment that getfacl is throwing out at you. The issue is that permissions are calculating so that "app" isn't getting the write bit set. That's happening because the mask on the file is set to read-only. The mask is used to limit the amount of permissions that could possibly be given out on a particular file or directory. An ...


7

This will probably get closed for soliciting opinions or being too broad but I'll do my best. "UNIX ACL" is a really indirect way of referring to it. I'm supposing you mean POSIX-style ACL's. The chief drawbacks there are with the lack of expressiveness in the number of operations you can specify since it just extends the traditional read/write/execute ...


7

effective permissions are formed by ANDing the actual (real?) permissions with the mask.  Since the mask of your file is rw-, all the effective permissions have the x bit turned off.


7

Short answer: If you want mask with the execute bit on, you must explicitly set it using setfacl after touch. Security forbids its implicit setting. setfacl -n -m m::rwx foo "-n" to suppress recalculation of the mask (may not be needed). "m::rwx" sets the mask value to 'rwx'. Note that "m::x" would disable all reads and writes. I am unable to show ...


7

Hauke Laging’s answer is trying to say: Any program that creates a file or directory specifies the mode (permissions) that it wants that file to have.  This is almost always hard-coded in the C program (or whatever language is used) and is hardly ever directly accessible to the user.  Then the umask value and the default ACL can turn off permission bits, ...


7

This is a configuration that allows members of a group, acltest, to create and modify group files while disallowing the deletion and renaming of files except by their owner and "others," nothing. Using the username, lev and assuming umask of 022: groupadd acltest usermod -a -G acltest lev Log out of the root account and the lev account. Log in and become ...


7

One is not better than the other, they are just different methods and way of thinking. You can use both permissions system on the same path without problems. They interfere with each other when modifying owner's, owning group and other permissions: when setting current value for these from setfacl, it will actually set the posix permission, not the ACL one....


Only top voted, non community-wiki answers of a minimum length are eligible