ACL

Use Case

Peter, Paul and Mary are working with one directory tree. They share, use and edit the same files. They all belong to the system group users. But the directory the should be able to write on belongs to the group exchange.

/home   |
        /exchange  |
                   /peters_subdir |
                                  /peters_file.txt
                   /pauls_subdir  |
                                  /pauls_file.odf
                   maries_file.doc

Links

• Indiana University Dep. of Comupter Science
• Using ACLs with Fedora Core 2 (Linux Kernel 2.6.5)
• Very good article that sum's up the most common problems Ubuntu Forum
• German - Was ist die umask? Wie kann ich sie festlegen?
• German - Wie nutzt man ACLs (Access Control Lists) richtig?

Distribution specific

Ubuntu

apt-get install acl

Use it

Enable ACL

On some distributions, filesystems are already compiled with acl support. This is the case e.g. for xfs or reiserfs. Otherwise - and this is always wise - enable the ACL's in fstab explicitly:

/etc/fstab
/home   /dev/hdx   ext3   defaults,acl   1 2

Create a new group exchange

Create the new group exchange. In some cases it could be wise to create a user with the same name too, with its own home directory and the default group exchange.

Don't forget to set the default group for the userexchange, when you create it.

chgrp exchange /home/exchange/
chmod g+s /home/exchange

Add ACL support

Changing the default umask for the certain directory and all subdirectories

setfacl -d -m mask:007 /home/exchange/

Optional: You can also additionally do

setfacl -dm g:exchange:rwx /home/exchange

Now every file from any user accessing this directory will be readably/writable for the group exchange.

Remove ACLs

sudo setfacl -b /directory/to/remove/permissions/from

Samba

Prepare the directory

chown exchange.exchange /home/exchange
chmod 2775 /home/exchange
sudo setfacl -d --set u::rwx,g::rwx,o::rx /home/exchange

smb.conf

[exchange]
path = /home/exchange
browseable = yes
writable = yes
create mask = 0664
directory mask = 0775

NFS

At the time of writing this NFS and ACL not well supported under ubuntu.

Change your fstab mount options. Important is to add acl in the options part.

nfs_server:/home/exchange /home/your_account/exchange  nfs \
        rw,acl[,...]  0 0

Manually mount like this:

mount -t nfs -o rw,acl[,...] \
    nfs_server:/home/exchange /home/your_account/exchange

[,...] stands for e.g. one of these mount options

 ,rsize=8192,wsize=8192,user,timeo=10,intr

Backup

Tools like rsync, dump or tar don't support acl backup at time of this writing. This will change in future.

If you like to backup directories or files with acl's, you have to use the star (a tar clone) backup utility.

• Star ACL

Backup

cd /home
star -Hexustar -acl -c f=exchange.star exchange

Restore

star -acl -x f=exchange.star

Desktop

OpenOffice.org

Don't use OpenOffice own file - open/save dialogs. This is changed in Extras->Options->Defaults.

Gnome Nautilus

ACLs are not shown in nautilus when using an nfs share.