ACL tune2fs setfacl getfacl default acl (lesson 8)

By OK -
Give permission to more than one user or group on a file or directory
Set default permissions for newly created files and directories
The acl mount option needs to be set
  /etc/fstab or systemd
  tune2fs for Ext file systems
  in XFS it's a default mount option
Use setfacl and getfacl
----------------------------------------------
ldapuser@localhost$ mkdir -p /etc/folder
Permission denied

 root@localhost#setfacl -R -m u:ldapuser:rwx /etc
ldapuser@localhost$ mkdir -p /etc/folder
OK
----------------------------------------------
setfacl -m g:salex:rx /data/account
setfacl -m d:g:sales:rx /data/account #default ACL
[root@localhost kevin]# setfacl -R -m g:lisa:rx filek 
[root@localhost kevin]# getfacl filek 
# file: filek
# owner: kevin
# group: kevin
user::rw-
group::rw-
group:lisa:r-x
mask::rwx
other::r--

You should run 2 commands on directory +defaults
[root@localhost ~]# setfacl -R -m g:lisa:rw /home/kevin/dirk/
[root@localhost ~]# setfacl -m d:g:lisa:rw /home/kevin/dirk/


[root@localhost ~]# getfacl /home/kevin/filek 
getfacl: Removing leading '/' from absolute path names
# file: home/kevin/filek
# owner: kevin
# group: kevin
user::rw-
group::rw-
group:lisa:r-x
mask::rwx
other::r--


[root@localhost ~]# setfacl -m u:lisa:rx /home/kevin/dirk/
[root@localhost ~]# setfacl -m u:lisa:rx /home/kevin/filek 
[root@localhost ~]# su - lisa
Last login: Mon Jun  5 15:49:54 EDT 2017 on pts/1
[lisa@localhost ~]$ ll /home/kevin/
ls: cannot open directory /home/kevin/: Permission denied
[lisa@localhost ~]$ ll /home/kevin/dirk
ls: cannot access /home/kevin/dirk: Permission denied

ACL access on parent folder if there is explicit chmod deny
[root@localhost ~]# setfacl -Rm g:lisa:rx /home/kevin
[root@localhost ~]# setfacl -Rm u:lisa:rx /home/kevin
[root@localhost ~]# su - lisa
Last login: Mon Jun  5 15:54:24 EDT 2017 on pts/1
[lisa@localhost ~]$ ll /home/kevin/
total 4
drwxrwxr-x+ 2 kevin kevin 25 Jun  5 15:46 dirk
-rw-rwxr--+ 1 kevin kevin 29 Jun  5 15:43 filek
[lisa@localhost ~]$ ll /home/kevin/dirk/
total 4
-rw-rwxr--+ 1 kevin kevin 29 Jun  5 15:46 dfilekeving
[lisa@localhost ~]$ cat /home/kevin/filek 
Mon Jun  5 15:43:19 EDT 2017
[lisa@localhost ~]$ 

[lisa@localhost ~]$ getfacl /home/kevin/dirk/
getfacl: Removing leading '/' from absolute path names
# file: home/kevin/dirk/
# owner: kevin
# group: kevin
user::rwx
user:lisa:r-x
group::rwx
group:lisa:r-x
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:lisa:rw-
default:mask::rwx
default:other::r-x


[root@localhost ~]# touch /home/kevin/dirk/fileroot

on file there is no default settings


[root@localhost ~]# getfacl /home/kevin/dirk/fileroot 
getfacl: Removing leading '/' from absolute path names
# file: home/kevin/dirk/fileroot
# owner: root
# group: root
user::rw-
group::rwx                      #effective:rw-
group:lisa:rw-
mask::rw-
other::r--


Comments

Post a Comment

Popular posts from this blog

HAproxy logging

By OK -
ubuntu@ubuntu:/etc/haproxy$ cat /etc/rsyslog.d/haproxy.conf # Create an additional socket in haproxy's chroot in order to allow logging via # /dev/log to chroot'ed HAProxy processes $ModLoad imudp $UDPServerRun 514 local0.* -/var/log/haproxy-0.log local1.* -/var/log/haproxy-1.log ### keep logs in localhost ## $AddUnixListenSocket /var/lib/haproxy/dev/log ------------------- ubuntu@ubuntu:/etc/haproxy$ cat /etc/haproxy/haproxy.cfg global chroot /var/lib/haproxy user haproxy group haproxy log 127.0.0.1   local0         log 127.0.0.1   local1 notice daemon frontend www     bind 192.168.40.128:8282    # haproxy public IP     default_backend as-backend    # backend used backend as-backend    balance leastconn    mode http  server as1 192.168.40.128:8082 check    # application srv 1 defaults log ...
Read more

teamcity Automatic Agent Start under Linux

By OK -
Automatic Agent Start under Linux To run agent automatically on the machine boot under Linux, configure daemon process with the  agent.sh start  command to start it and  agent.sh stop  command to stop it. Refer to an example procedure below: 1. Navigate to the services start/stop services scripts directory: cd /etc/init.d/ 2. Open the build agent service script: sudo vim buildAgent 3. Paste the following into the file : #!/bin/sh ### BEGIN INIT INFO # Provides: TeamCity Build Agent # Required-Start: $remote_fs $syslog # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Start build agent daemon at boot time # Description: Enable service provided by daemon. ### END INIT INFO #Provide the correct user name: USER="agentuser" case "$1" in start) su - $USER -c "cd BuildAgent/bin ; ./agent.sh start" ;; stop) su - $USER -c "cd BuildAgent/bin ; ./agent....
Read more

NFS mount add in fstab _netdev instead of default | firewall-cmd --list-all

By OK -
Redhat recommends us to add  _netdev  option for NFS file system in /etc/fstab. So that they can be mounted after starting the networking service. Alternative ways to refer to partitions: Label : LABEL=label Network ID Samba : //server/share NFS : server:/share SSHFS : sshfs#user@server:/share Device : /dev/sdxy (not recommended) Example #1 //192.168.1.134/share_name /mnt/share_name cifs username=server_user,password=server_password,_netdev 0 0 ^ Path to your share ^ Mountpoint ^ Username ^ Password ^ See note A Note A: The  _netdev  options makes sure the mount is only attempted AFTER a network connection has been established. Example #2 10.10.10.1:/vol1/fs1 /data nfs defaults,_netdev 0 0 ============================ [root@localhost ~]# firewall-cmd --list-all public   target: default   icmp-block-inversion: no   interfaces:   sources:   services: dhcpv6-client high-availabi...
Read more