Filesystem/Access Control List Guide

Access Control Lists (ACLs) are one of the more important feature required by current enterprise or co-operate needs. They facilitate more control over files above User, Group and Other POSIX Basic ACL.

POSIX basic ACL
Some example on ls -al /var/log:

As you might know for example:

drwxr-xr-x 2 apache  apache       135 Dec 11 17:48 apache2

What is missing?

1. What happens if more than one user needs control of this directory? A: We cannot, but you can add these users to the "apache" group. Problem is, these users will have access to everything the "apache" group has access.

2. What happens if we need one more group to have read/write access to this directory but no other users? A: We cannot, but in the same way we can add all the other group users and the "apache" user to another group and let them have access to said group.

But what happens if you want to make this group read-only and not write?

POSIX Basic ACL has its limitations and so we introduce "extended ACL" which fixes many issues.

Kernel
Each filesystem must include support for extended access control from the kernel before it can be used by the application.

Enable the one(s) needed:

Save your changes and recompile your kernel and boot from it.

Emerge
Now emerge the ACL tools to start using ACL:

ext2/3/4 /etc/fstab with ACL support
Some filesystems like xfs enable extended ACL by default when mounted.

Some filesystems like ext2/ext3/ext4 and reiserfs require extra mount options to enable extended ACL. Just add the ACL options in :

Re-mount the partition with the acl option to finish.

Running extended ACL
How do we know that extended ACL is running correctly?

You will be able to do the following:


 * Set/Modify ACL
 * Get/Read ACL
 * ACL Mask

Set/Modify ACL
To set ACLs the setfacl command must be invoked. You can read the man page for setfacl for more options

To add username to have read, write and execute on :

To add username to have +write access on :

To add default user access right to read and write on folder:

To add groupname to have read, write and execute on :

To add groupname to have recursive +execute on :

To add default group access right to read and write on folder

Get/Read ACL
To get ACL we need to run the getfacl command. Read getfacl's man page for more options.

To get ACL on :

Remove ACL
To remove ACL are simple.

Remove all ACL on /testfiles

Remove default ACL on testfolder:

Which files/folder are with ACL?
How do you know that your files is with ACL without running getfacl on all files?

Luckily ls will show you a  sign if it had ACL.

Notice the  Sign on apache2 and also named?