This occurs also if you create a file that is readable, then chmod 700.
Can some explain the effective rights for me and why its overiding the acls where the files are either chmod 700, or written as 700 by the process that is writing them? I know this is the correct behaviour, I am just trying to understand why this is.
Hey everyone, I was wondering if there was a quicker way to chmod a lot of files than doing what im currently doing.
At the moment, im doing chmod 777 *filename* - but I have a lot of files, sub-directories, sub-files etc etc. And at the moment I see I have to chmod every single file... (3 Replies)
Hello,
I have a directory and a list of files in it on which I'd like to set ACLs and quota.
To set ACLs regarding the UGO rights set at the moment, I haven't found any other way than grabbing the UGO rights set on the file with a shell cut command and then applying setfacl commands to that... (2 Replies)
Hi guys,
There is a line in squid default configuration:
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
acls are applied from top down, so CONNECT acl will deny access to all non SSL and SSL ports. I mean it never reaches the second access rule. (0 Replies)
Hi everybody
As the title says I wonder if the usual (in my case Ubuntu 14.04 LTS) linux installation root does in fact uses any of the ACLs possible extensions in any of its files/dirs
I ask this because I usually use tar to backup the entire root (in offline) with a command like this (root... (2 Replies)
Hello experts,
I would like to know if is possible to create a default acl rule to a directory.
in this directory all files created should have executable permissions by the group IT.
i tried setfacl -m d:g:it:rwx /files
tried to change the mask setfacl -m m::rwx /files
but i still... (3 Replies)
I work on a distribution application on Linux which generates bulk reference data extract feeds and stores them on a Linux server. I have several consumer applications access the files stored on this Linux server using FTPS protocol. However in order for consumer applications to have access to... (2 Replies)
Hi,
I need to grant read permission to a normal user on sulog file on AIX 6.1.
As root I did acledit sulog and aclget shows "extended permissions" as "enabled" and normal user "splunk" has read permissions. When I try to access sulog as splunk user it won't allow and aclget for splunk user... (6 Replies)
Discussion started by: prvnrk
6 Replies
LEARN ABOUT XFREE86
getfacl
getfacl(1) User Commands getfacl(1)NAME
getfacl - display discretionary file information
SYNOPSIS
getfacl [-ad] file...
DESCRIPTION
For each argument that is a regular file, special file, or named pipe, the getfacl utility displays the owner, the group, and the Access
Control List (ACL). For each directory argument, getfacl displays the owner, the group, and the ACL and/or the default ACL. Only directo-
ries contain default ACLs.
The getfacl utility may be executed on a file system that does not support ACLs. It reports the ACL based on the base permission bits.
With no options specified, getfacl displays the filename, the file owner, the file group owner, and both the ACL and the default ACL, if it
exists.
OPTIONS
The following options are supported:
-a Displays the filename, the file owner, the file group owner, and the ACL of the file.
-d Displays the filename, the file owner, the file group owner, and the default ACL of the file, if it exists.
OPERANDS
The following operands are supported:
file The path name of a regular file, special file, or named pipe.
OUTPUT
The format for ACL output is as follows:
# file: filename
# owner: uid
# group: gid
user::perm
user:uid:perm
group::perm
group:gid:perm
mask:perm
other:perm
default:user::perm
default:user:uid:perm
default:group::perm
default:group:gid:perm
default:mask:perm
default:other:perm
When multiple files are specified on the command line, a blank line separates the ACLs for each file.
The ACL entries are displayed in the order in which they are evaluated when an access check is performed. The default ACL entries that may
exist on a directory have no effect on access checks.
The first three lines display the filename, the file owner, and the file group owner. Notice that when only the -d option is specified and
the file has no default ACL, only these three lines are displayed.
The user entry without a user ID indicates the permissions that are granted to the file owner. One or more additional user entries indi-
cate the permissions that are granted to the specified users.
The group entry without a group ID indicates the permissions that are granted to the file group owner. One or more additional group
entries indicate the permissions that are granted to the specified groups.
The mask entry indicates the ACL mask permissions. These are the maximum permissions allowed to any user entries except the file owner, and
to any group entries, including the file group owner. These permissions restrict the permissions specified in other entries.
The other entry indicates the permissions that are granted to others.
The default entries may exist only for directories. These entries indicate the default entries that are added to a file created within the
directory.
The uid is a login name or a user ID if there is no entry for the uid in the system password file, /etc/passwd. The gid is a group name or
a group ID if there is no entry for the gid in the system group file, /etc/group. The perm is a three character string composed of the let-
ters representing the separate discretionary access rights: r (read), w (write), x (execute/search), or the place holder character -. The
perm is displayed in the following order: rwx. If a permission is not granted by an ACL entry, the place holder character appears.
If you use the chmod(1) command to change the file group owner permissions on a file with ACL entries, both the file group owner permis-
sions and the ACL mask are changed to the new permissions. Be aware that the new ACL mask permissions may change the effective permissions
for additional users and groups who have ACL entries on the file.
In order to indicate that the ACL mask restricts an ACL entry, getfacl displays an additional tab character, pound sign (#), and the
actual permissions granted, following the entry.
EXAMPLES
Example 1: Displaying file information
Given file foo, with an ACL six entries long, the command
host% getfacl foo
would print:
# file: foo
# owner: shea
# group: staff
user::rwx
user:spy:---
user:mookie:r--
group::r--
mask::rw-
other::---
Example 2: Displaying information after chmod command
Continue with the above example, after chmod 700 foo was issued:
host% getfacl foo
would print:
# file: foo
# owner: shea
# group: staff
user::rwx
user:spy:---
user:mookie:r-- #effective:---
group::---
mask::---
other::---
Example 3: Displaying information when ACL contains default entries
Given directory doo, with an ACL containing default entries, the command
host% getfacl -d doo
would print:
# file: doo
# owner: shea
# group: staff
default:user::rwx
default:user:spy:---
default:user:mookie:r--
default:group::r--
default:mask::---
default:other::---
FILES
/etc/passwd system password file
/etc/group group file
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Availability |SUNWcsu |
+-----------------------------+-----------------------------+
|Interface Stability |Evolving |
+-----------------------------+-----------------------------+
SEE ALSO chmod(1), ls(1), setfacl(1), acl(2), aclsort(3SEC), group(4), passwd(4), attributes(5)NOTES
The output from getfacl is in the correct format for input to the setfacl -f command. If the output from getfacl is redirected to a file,
the file may be used as input to setfacl. In this way, a user may easily assign one file's ACL to another file.
SunOS 5.10 5 Nov 1994 getfacl(1)
08-02-2013
