Difference between revisions of "ACL"
From Blue-IT.org Wiki
(→Distribution specific) |
(→Create a new group ''exchange'') |
||
| Line 33: | Line 33: | ||
===Create a new group ''exchange''=== | ===Create a new group ''exchange''=== | ||
Create the new group '''exchange'''. In some cases it could be wise to create a user with the same name too, with its own ''home'' directory and the default group ''exchange''. | Create the new group '''exchange'''. In some cases it could be wise to create a user with the same name too, with its own ''home'' directory and the default group ''exchange''. | ||
| − | Don't forget to set the '''default group''' for the user. | + | |
| + | Don't forget to set the '''default group''' for the user''exchange'', when you create it. | ||
chgrp exchange /home/exchange/ | chgrp exchange /home/exchange/ | ||
chmod g+s /home/exchange | chmod g+s /home/exchange | ||
Revision as of 22:46, 25 November 2007
Contents
Use Case
Peter, Paul and Mary are working with one directory tree. They share, use and edit the same files. They all belong to the system group users. But the directory the should be able to write on belongs to the group exchange.
/home |
/exchange |
/peters_subdir |
/peters_file.txt
/pauls_subdir |
/pauls_file.odf
maries_file.doc
Links
- Indiana University Dep. of Comupter Science
- Using ACLs with Fedora Core 2 (Linux Kernel 2.6.5)
- Very good article that sum's up the most common problems Ubuntu Forum
- German - Was ist die umask? Wie kann ich sie festlegen?
- German - Wie nutzt man ACLs (Access Control Lists) richtig?
Distribution specific
Ubuntu
apt-get install acl
SuSE 10.3
zypper install nfs-kernel-server yast2-nfs-server
Use it
Enable ACL
On some distributions, filesystems are already compiled with acl support. This is the case e.g. for xfs or reiserfs. Otherwise - and this is always wise - enable the ACL's in fstab explicitly:
/etc/fstab /home /dev/hdx ext3 defaults,acl 1 2
Create a new group exchange
Create the new group exchange. In some cases it could be wise to create a user with the same name too, with its own home directory and the default group exchange.
Don't forget to set the default group for the userexchange, when you create it.
chgrp exchange /home/exchange/ chmod g+s /home/exchange
Add ACL support
Changing the default umask for the certain directory and all subdirectories
setfacl -d -m mask:007 /home/exchange/
Optional: You can also additionally do
setfacl -dm g:exchange:rwx /home/exchange
Now every file from any user accessing this directory will be readably/writable for the group exchange.
Remove ACLs
sudo setfacl -b /directory/to/remove/permissions/from
Samba
Prepare the directory
chown exchange.exchange /home/exchange chmod 2775 /home/exchange sudo setfacl -d --set u::rwx,g::rwx,o::rx /home/exchange
smb.conf
[exchange] path = /home/exchange browseable = yes writable = yes create mask = 0664 directory mask = 0775
NFS
Change your fstab mount options. Important is to add acl in the options part.
nfs_server:/home/exchange /home/your_account/exchange nfs \
rw,acl[,...] 0 0
Manually mount like this:
mount -t nfs -o rw,acl[,...] \
nfs_server:/home/exchange /home/your_account/exchange
[,...] stands for e.g. one of these mount options
,rsize=8192,wsize=8192,user,timeo=10,intr
Backup
Tools like rsync, dump or tar don't support acl backup at time of this writing. This will change in future.
If you like to backup directories or files with acl's, you have to use the star (a tar clone) backup utility.
Backup
cd /home star -Hexustar -acl -c f=exchange.star exchange
Restore
star -acl -x f=exchange.star
Desktop
OpenOffice.org
Don't use OpenOffice own file - open/save dialogs. This is changed in Extras->Options->Defaults.
Gnome Nautilus
ACLs are not shown in nautilus when using an nfs share.