File Access Control List

Introduction scenarios:

Files created by Tom: The owner is Tom, and the owner group is Tom.

Jerry wants to access the file created by Tom: the other must have the RW-permission. This is very dangerous.

Another way is to change the owner of the file to Jerry, but normal user Tom cannot execute the command chown.

This introduces the facl concept.

Facl: File Access Control List

Use File Extension attributes to save additional access control permissions

Setfacl: Set facl

-M: set an additional access control list.

U: uid: perm

G: GID: perm

-X: Undefined additional access control list

U: uid

G: GID

-RW-r -- +: + indicates that the file has extended attributes.

Getfacl: Get facl

General:

Owner ---> group ---> Other

When there is an additional facl:

Owner ---> facl, user ---> group ---> facl, group ---> othen

File Access Control List