Now since we are on the topic of assigning
permission to files, and directories, and changing
groups and ownership, we have to look into Access
Control List as well. Access Control List is
another layer or I would say a top layer or
additional layer that runs on top of your
permissions, which allows you to assign permission
per user. So what is ACL? ACL stands for access
control list, which provides an additional, more
flexible permission mechanism for file systems. It
is designed to assist with UNIX file permissions.
ACL allows you to give permission for any user or
group to any disk resources.
The use of ACL, what is the purpose? Think of a
scenario in which a particular user is not a
member of a group created by you. So let's say if
you create a user ABC, and it's not member of the
group root, but you still want to give some read
or write access, how can you do it without making
the user member of the group. And that's where we
have Access Control Lists, which will help us do
it. So let me put it in a very simple words one
more time. So let's say if you want to allow a
file that is created by root and allow the user to
read that file. Now that user is a regular user,
not part of the group root, and you want that user
to read that file. So of course, the one way to do
it is you change the read permission of others, the
last three bits, so others can read it. But then,
everyone else could read that. But we only want
one user to read that instead of all other users
to read it. That is why we only give permission to
that particular user using ACL. Hope that
clarifies. So basically, ACLs are used to make a
flexible permission mechanism in Linux. From Linux
man pages, ACLs are used to define more fine-grained,
discretionary access rights for files and
directories. The commands to assign and remove ACL
permissions are setfacl and getfacl.
So set file ACL, get file ACL. get file ACL will
give you the information about the existing
permissions of a file, and set will allow you to
set the way you wanted to set. Let's look at a
few examples. Here are the list of commands for
setting up ACLs. To add permission for a user, you
have to run a command setfacl with
minus m option to modify, u for user, and then
you have to separate it with the colons. Here user
is the user name, in my case, it will be iafzal,
and then colon, and the permission that
you want to give that user to. And then of course,
the last part is the file name, which
file do you want to get the permission to. Make
sure you specify the complete absolute path. To add
permission for a group, you can also allow the
permissions to a specific group. So again, if you
give permission, let's say read permission to
the group, that middle three bits, then every group
in your Linux system can read it. But what if you
only want one group to read it? Right, that could
be a problem. So then again, access lists, Access
Control Lists comes to the rescue. And to add that
group, to allow it to read or write that specific
file, you have to set with g, and group name, and
the permissions. To allow all files or directories
to inherit ACL entries from the directory, it is
for then meaning cascading, which will be set with
minus dm option and an entry whatever that you
want to put in and the name of the file or
directory. Sorry, of course, the directory because
you want to cascade, a file cannot have a file
within itself. So that's why directory will have
to have that. To remove a specific entry, so you
will have to do setfacl with -x to remove
it, and then you have to specify the user and the
name of the file. This is only for a specific
user. Now let's say if you want to remove all the
ACL permissions from everyone, then you have to do
setfacl with -b option and the name of the
file. A couple of things that you need to remember.
One is, as you assign the ACL permission to a
file or directory, you will see that it will add a
plus sign at the end of the permission. So when
you run ls -l, the first column, which shows
you the permissions, it adds the plus sign at the
end of it, which shows that it has an ACL assigned
to it. The second thing is setting with w
permission with ACL does not allow you to remove a
file, so you could modify the file, edit the file,
but you cannot delete that file. That is something
that still the user keeps the permission to itself
to delete it. So now let's get into a Linux
machine, and we'll try a couple of these commands,
to learn how we could set ACL permissions to a
file that is owned by someone else.
[No audio]
Okay, I am logged in as root. And of
course, you can always check the root has the
pound or hash sign to it. But again, always make
sure, make sure you are on the right computer. And
I am on my right machine. I am in my tmp
directory, and I'm going to create a file. Let's
say I'm going to call it Texas. And I'm going to
pick just tx as an acronym. Let's make sure it is
created and has a write permission. As you could
see it is created, owned by root, and owned by group
root. And the owner can read, write, the group can
only read, and others can only read. If you do getfacl
on the file, you will see more information.
Again file, is this, owner, group, this user
permission, group permission, other permission. Now
comes to a part where you want to allow everyone
sorry, where you want to allow only iafzal to
write to that file. Then iafzal as you know,
counts or is considered as others, right. iafzal
falls in this category. So if you give write here,
if you give that permission as w right here, then
what will happen, everyone else can write to that
file. So again, I hope you understand where I'm
getting at. So to overcome this problem where only
one user can modify that file, then you will
assign it as a setfacl. So do setfacl -m
to modify your permissions, u for user, who's the
user, iafzal, and what permission you want to give,
you want to give read, and write. And the name of
the file would be tmp, and a file name is tx.
But before we run it, I just wanted to go in, and
start sorry, not this, I want to go in and start a
duplicate session and I want to log in as iafzal.
[No audio]
Right now if I do cd /tmp, and cat tx,
there is nothing in there. By the way, first of
all, sorry, not cat because everyone could read
it. So I shouldn't have a problem. But what if I
want to edit it, so vi tx.
[No audio]
It says at the bottom right here readonly. So even if I put in
something, hello, or whatever that you want to put
and save it, it will tell me I can't open up all
it's not editable, I do not have permission. So I
cannot do it. When I run this command, getfacl,
sorry, setfacl, with iafzal, with
read as well and write as well for that file,
hit Enter. Now to verify it, if it actually has
set those permission you do getfacl /tmp/tx, and
you will see right now, right here, it says user iafzal
has the right to modify it. Now if I do vi
tx now, you see I do not have that same error
that I was getting it before I could just put in
anything I want. Hellow TX, oops, Hello TX.
Save it. And it lets me save it. And when I do cat
on tx, I am able to do that on tx. So that's why
these ACL are so important to assign that specific
permission to a specific user. Same thing if you
want to do that group
[No audio]
assignment to the
permission, you would run the same command, but
instead of u, you put in g, and hit enter. And
when you do getfacl, you will see now group iafzal also
can modify this file. So if a user is
part of my group, they could actually go in and
modify the file. Going to number four, the number
three, one is to actually assign those permissions
and cascade down to every file and directory,
which is very simple. So I'll jump right into
number four. To remove that specific permissions, I
will have to do set
[No audio]
facl -x, and what are you taking out,
you're taking out the user iafzal's permission.
And for that, you have to type the file name, run
getfacl, and you'll see that iafzal user is
gone. But what if you want to remove everything,
not just user, but every permission for every user
or every group, then you will have to run the
command setfacl as -b option. And now
when you do getfacl, you'll see it's back to its
original state. That's how it works. And when I
said you cannot delete, even though I do have the
right permission to write to the file, edit the
file, I cannot delete that. So if I do rm tx, by
the way, I have to give the permission back again.
[No audio]
This is permission. Let's verify it again. Yes, I
do have permission to read and write to it. So if
I tried to remove it, it will say Operation not
permitted. So the reason I'm including that so I
don't want you to waste your time by you know,
trying to delete that file and thinking, hey, I do
have the right permission. But why can I not
delete it? The reason that ACL does not put that
in there, so it only gives you a right to only
that user, just in case by accident, that user
deletes a file. So that's how the ACL permission
works. It's very granular. And it goes down to the
user level. And again, one more time, the reason
it was built or it was introduced into the Unix or
Linux environment is so you, we could assign
permission to the user, not to the every user but
to a specific user. So try it out and try
it on different files, try on
different directories, see how the directory works
as well how it could change the files if you could
log in, cd into the directory by giving specific
access to a user.
[No audio]