Does ACL can only grant/deny access for specific command?


 
Thread Tools Search this Thread
Operating Systems AIX Does ACL can only grant/deny access for specific command?
# 1  
Old 03-10-2010
Does ACL can only grant/deny access for specific command?

Dear AIX/UNIX experts:

I have a demand to restricted a file to be copy by others, but this file must can be read by others/Applications.

As I tried, the chmod command cannot fulfill this requirement. But not sure if the ACL can achieve this function or not ?

Could anybody give me your valuable advice ?

Thanks a lot!

David
# 2  
Old 03-10-2010
check this link

http://en.wikipedia.org/wiki/File_system_permissions

If u want to achieve this give read permission to all

Code:
chmod 444 filename

For full permision to the user and read permission to others & group.

Code:
chmod 744 filename


Last edited by amitranjansahu; 03-10-2010 at 05:10 AM..
# 3  
Old 03-10-2010
Hi amitranjansahu,

Thanks for your response.

Your solution would allow the other user can copy the file!

What I want is: allow the other user to read but restrict them to copy that file.
# 4  
Old 03-10-2010
Just a question: how exactly should the system differentiate between a user reading the file, and a user reading the file and saving the contents to a different file? That would only work if you could restrict the read permission to a certain program, and only that program, which isn't possible with AIX ACLs as far as I know.
# 5  
Old 03-10-2010
Hi Pludi,

Thanks for explanations. I understand what is your concern.
First, the file is not a text file(maybe compiled).
Second, I just restrict it to be used on this system only.

Thanks!
# 6  
Old 03-10-2010
If a file can be read, it can be copied.
Simple.
If the file has read permission then the user with read permission can simply read the file and direct the output to another file, then they have a copy.
I do not think you can stop a file with read permission from being copied.
cat file > file2
Then you have a copy of file called file2.
Even if it is a bin file cat -vet file > file2 will probably make a usable copy.
How could you stop this?
Permissions and even acl will not help here.
# 7  
Old 03-11-2010
devyfong have you tried restricted Shell?
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. IP Networking

ACL Deny for large IP Scope

I have a large scope of 7,700 IPs that I want my proxy to allow and block everything else. Is such a large block possible with Squid? (1 Reply)
Discussion started by: BobSpero
1 Replies

2. UNIX for Dummies Questions & Answers

Deny to edit a specific file in sudoers

How do I deny a user to edit a specific file in directory but the user will have a capability to use sudo and execute any command? I will just deny him/her to edit sayy 5files in different directories in linux? example. He cannot edit /etc/modprobe.d/blacklist.conf and /etc/sshd.config? Then the... (6 Replies)
Discussion started by: lhareigh890
6 Replies

3. Web Development

Deny access from all users, except PHP application installed in same domain

Hi to all, Please, some help over here. IŽll try to be as much clear I can. In summary my problem is: I have a PHP application installed in a folder of my domain that reads CSV.txt files from another folder in my domain and I need to restrict direct access to see and download these CSV.txt... (0 Replies)
Discussion started by: cgkmal
0 Replies

4. Emergency UNIX and Linux Support

Configure Squid to use LDAP group auth to deny internet access

Hi all We have squid-2.5.STABLE11-3.FC4 running in our environment. LDAP authentication works fine. Active Directory 2003 Users are prompted to enter credentials every time they access the net. The system works perfectly, but I need to configure Squid to block users in a specific AD group.... (1 Reply)
Discussion started by: wbdevilliers
1 Replies

5. Shell Programming and Scripting

how i can make one ip access to ftp account and deny others

HI I want to make only one IP can access to ftp acount in cpanel or by shell can any body help me ? (1 Reply)
Discussion started by: elkadrey
1 Replies

6. Cybersecurity

file permission/acl: 2 users with write access on 1 file...

Hello, i need some help/advice on how to solve a particular problem. these are the users: |name | group | ---------- --------------- |boss | department1 | |assistant | department1 | |employee | department1 | |spy | department2 | this is the... (0 Replies)
Discussion started by: elzalem
0 Replies

7. Solaris

how to deny ftp access

Hi , I want to deny ftp access to some user. Currently I don't have /etc/ftpusers file. From the man page , i can modify the login shell at /etc/passwd to invalid one. How to add it ? replaced with /dev/null or something. If you have any other method to disabled it . Pls show me. My FTP is... (10 Replies)
Discussion started by: skully
10 Replies

8. IP Networking

how to deny someone to use ftp command ?

hi,all, i have a question to trouble you. a workstation named AAA, and open the ftp services to permit user download and upload files. i have root password. a pc install windows 2k named BBB, someone install a serv-u ftp ( a ftp server software ) to transfer data. i don't have the... (4 Replies)
Discussion started by: yarx
4 Replies

9. Filesystems, Disks and Memory

ACL problem due to mv command used in solaris

Hi All, Is there any way to use mv command and that should apply ACL on the moved files that is already set in distination location This mv command is running in a solaris system. File system is NFS. Problem I am facing : Currently mv command removes ACL from moved files and also it... (0 Replies)
Discussion started by: Tlogine
0 Replies

10. UNIX for Dummies Questions & Answers

Deny dba command to a user group!!

Dear all i am relatively new in using UNIX i have a problem, We are using IBM Informix Dynamic Server Version 9.40.FC7W4 we have 2 bsic user groups that we are using the 1st is root and another i wasnt to restrict the command "dba" that takes the users of that group to the database. I have... (3 Replies)
Discussion started by: masquerer
3 Replies
Login or Register to Ask a Question