- In this video I wanna tell you
about file access control lists.
So file access control lists
or short ACLs allow administrators to grant permissions
to more than one user and or more than one group.
It's a solution for the problem that in Linux security
a file can have one user who is owner
one group that is owner.
But how are you going to deal with the situation
where the user owner need to read, write
and one specific user needs read access for instance.
That is why we have access control lists.
ACLs are supported by all modern file systems as a default
so you don't need to do anything anymore
and you can use getfacl to show current ACL settings.
Setfacl is used to manage ACLs.
ACLs may be used in different situations, for instance
in a shared user environment where one user
or group needs full access to files
and other users or groups need read-only access.
Or in a developer environment where a developer
may require access to documents like server document root.
So how do we manage them?
Well there is getfacl which you can use
to see current ACL settings
and setfacl to manage the ACLs.
Then there is a difference
between the regular ACL which will take care of
all the currently existing files.
And the default ACL you will take care
of all new files that you will be creating
from that moment on.
One recommendation, use ACLs as an infrastructural solution.
They should be configured on directories
before you start to work with files
in these directories so that you can set default ACLs
and all the files that you will create from that moment on
will get the the appropriate ACL permissions.
Let me demonstrate.
So to do this demo I need to create a group,
groupadd, account, and I need to create directory.
Mkdir -p /data /sales.
And we also need a sales group.
So groupadd sales.
Now I'm taking care of the basic permissions
on the directory.
So that would be chgrp sales on data sales.
To make the group sales owner of the directory.
And chmod like 770 on data sales.
Let's do an ls - ld on data sales
to monitor the current settings.
And there we go.
So as you can see, the group sales is group owner.
We don't care about user owner.
Permission mode is set to 770.
Now I'm going to create a couple of files.
So touch /data/sales/file
1..10.
And again ls-ld on data sales.
And there we can see all of these sales.
Good. Now I'm going to take care of my ACL.
So setfacl -R for recursive -M for modify
g:account: r uppercase X on data sales.
In case you are thinking the uppercase X is not a typo
because if you do a recursive access control lists
then you need the execute permission to be set
on sub directories but not on files
and that's exactly what the uppercase X is doing.
Without the uppercase X you will now see
an execute permission on all of these files.
You don't want that but we have the uppercase X.
We did not have any sub directories here
but in case we would have sub directories
and the sub directory will be read executable
for the account group.
Good.
Now we are going to investigate.
Getfacl on data sales file1
and what do we see?
Well we see that the group account has reached permissions
and that's exactly what we wanted.
Now let's take care of the default ACL assignment.
That will be setfacl -m d:
g:account: rx on data sales.
Now what is the result?
Well the result is that if I am going to create a new file,
touch/data/sales/newfile
and then I'm using a getfacl on newfile.
Then you can see the default ACL has been applied.
So new file has the group account with read and execute.
Now in the default ACL you don't need an uppercase X
because the default ACL comes with a mask
and the mask is automatically filtering out
the execute permission.
And that is why group account effectively
has read permissions on the file
that I just created and that's how it works.