Use of Linux ACL permissions

I. Introduction of ACL usage

ACLs are the main purpose of access Control List to provide specific permission settings other than the traditional owner,group,others Read,write,execute permissions, which can be r,w for a single user, a single file, or a directory. The privilege control of x is useful for use situations that require special permissions. For example, a file that does not allow a single user to access it.

Second, Getfacl, setfacl Two command introduction and common options

1, ACL use two command to control it

Getfacl: Get ACL Settings item for a file/directory

Setfacl: Setting ACL settings items for a file/directory

2. Setfacl parameters

-M: Set subsequent ACL parameters

-x: Remove subsequent ACL parameters

-B: Remove all ACL parameters

-K: Remove default ACL parameters

-R: Recursively set ACLs, including subdirectories

-D: Set default ACL

Iii. Examples of Use

In the Linux system we are using ordinary users (Cangls) to edit the text file, you may want to edit other ordinary users (Bols) files, usually we think of the following two solutions: 1, Use the root user to add a normal user (Cangls) to the group (Bols) to which you want to edit the file, and then you can edit the file more as a group write permission. 2, if we do not want to use the root user to change the permissions, you can let the edited file belongs to the main (Bols) in the text of other permissions to add write permissions. The above two solutions, although all can solve the problem but the root authority in the production server is generally not random login, and the second although can solve the problem but because other users also have write permission, if the use of a person is not worth the benefit of the people, Today, I would like to introduce you to a solution that avoids both of the above problems by using the Setfacl command.

1, the use of environmental enumeration

[[email protected] test]$ whoami bols[[email protected] test]$ touch Bols.txt[[email protected] test]$ ls-l bols.txt-rw- rw-r--1 bols bols 0 July 9 Bols.txt

[[email protected] test]$ whoami cangls[[email protected] test]$ echo "Cangls" > Bols.txt-bash:bols.txt: Insufficient Permissions

2. Change the file with the owner's permission given by the SETFACL command

[Email protected] test]$ getfacl bols.txt # file:bols.txt# owner:bols# group:bolsuser::rw-group::rw-other::r--[[email Protected] test]$ setfacl-m u:cangls:rw-/tmp/test/bols.txt Try ' Getfacl--help ' for more information. [Email protected] test]$ getfacl bols.txt # file:bols.txt# owner:bols# group:bolsuser::rw-user:cangls:rw-group::rw-ma Sk::rw-other::r--[[email protected] test]$ ls-l bols.txt-rw-rw-r--+ 1 bols bols 12 July 9 08:33 bols.txt

[Email protected] test]$ echo "Cangls" > bols.txt [[email protected] test]$ cat Bols.txtcangls

[[email protected] test]$ setfacl-x U:cangls bols.txt//cancel permissions [[email protected] test]$ Getfacl Bols.txt # FILE:BOLS.TX t# owner:bols# group:bolsuser::rw-group::rw-mask::rw-other::r--[[email protected] test]$ echo "Bols" > Bols.txt-bas H:bols.txt: Insufficient Authority

3, use the SETFACL command to assign the permissions of the group to change the file

[Email protected] test]$ setfacl-m g:cangls:rwx bols.txt [[email protected] test]$ getfacl bols.txt # file:bols.txt# ow ner:bols# Group:bolsuser::rw-group::rw-group:cangls:rwxmask::rwxother::r--[[email protected] test]$ ls-l bols.txt- rw-rwxr--+ 1 Bols bols 12 July 9 08:33 bols.txt

[Email protected] test]$ echo "Bols" >> bols.txt [[email protected] test]$ cat Bols.txtcanglsbols

[Email protected] test]$ setfacl-x G:cangls bols.txt [[email protected] test]$ Getfacl bols.txt # file:bols.txt# owner: bols# Group:bolsuser::rw-group::rw-mask::rw-other::r--[[email protected] test]$ echo "Bols" > BOLS.TXT-BASH:BOLS.T XT: Insufficient Permissions

4.-R Recursive Directory usage example

[[email protected] tmp]$ setfacl -r -m   u:cangls:rwx /tmp/test/[[email protected] tmp]$ getfacl /tmp/test/bols.txt  getfacl: Removing leading  '/'  from absolute path names# file:  tmp/test/bols.txt# owner: bols# group: bolsuser::rw-user:cangls:rwxgroup::rw-mask:: rwxother::r--[[email protected] tmp]$ getfacl /tmp/test/getfacl: removing  leading  '/'  from absolute path names# file: tmp/test/# owner:  bols# group: bolsuser::rwxuser:cangls:rwxgroup::rwxmask::rwxother::r-x[[email protected]  Tmp]$ ls -ld test/drwxrwxr-x+ 2 bols bols 4096 7 Month    9  08:00 test/

[Email protected] test]$ echo "Cangls" >> bols.txt [[email protected] test]$ cat Bols.txt Canglsbolscangls

Through the above three simple small examples can be seen through the SETFACL command can be a good solution to the problem of file permissions, hope that through this example of the skills of learning can give you the convenience of learning work.

This article is from the "Bread" blog, make sure to keep this source http://cuchadanfan.blog.51cto.com/9940284/1672705

Use of Linux ACL permissions