Configuring ACL on AIX 5.3


 
Thread Tools Search this Thread
Operating Systems AIX Configuring ACL on AIX 5.3
# 1  
Old 06-08-2010
Configuring ACL on AIX 5.3

Hello All,

Let me quickly come down to my problem..

I have a file with following description:

==
root:/me01/tia/filetr ans # ls -lrt DW_NUM_OF_ROWS_TSP.txt
-rwxrwxr-- 1 tiaoas oinstall 43 Jun 07 17:12 DW_NUM_OF_ROWS_TSP.txt
root:/me01/tia/filetrans # aclget DW_NUM_OF_ROWS_TSP.txt
*
* ACL_type AIXC
*
attributes:
base permissions
owner(tiaoas): rwx
group(oinstall): rwx
others: rwx
extended permissions
enabled
permit rw- u:tiaadm,g: oinstall
==

I wanted user 'tiaadm:staff' to be able to do a 'chmod 777 DW_NUM_OF_ROWS_TSP.txt' -- for which I permitted this user for 'rw' as shown in the 'aclget' o/p above. However, my purpose was that any file which begins with 'DW', user 'tiaadm:staff' should be able to do a 'chmod', hence setting ACL for individual files wasn't quite a right option.
Google'ng around, someone suggested to set the ACL for the parent directory under which files starting with 'DW' exists, so this is what I did:

==
aclget DW_NUM_OF_ROWS_TSP.txt | aclput -R /me01/tia/filetrans
==

With this, my purpose wasn't solved as new files(getting created) starting with 'DW' under ~/filetrans directory didn't allow user 'tiaadm:staff' to do a 'chmod 777'.
Later, some online forum suggested to use "Extended Attribute Format" for inheritance under directories, so this is what I did:

==
root:/ # chfs -a ea=v2 /me01

root:/me01/tia # aclconvert -t NFS4 filetrans

root:/me01/tia # aclget filetrans
*
* ACL_type NFS4
*
*
* Owner: tiaesg
* Group: oinstall
*
s: (OWNER@): a rwpRWxDaAdcCs
s: (OWNER@): d o
s: (GROUP@): a rwpRWxDadcs
s: (GROUP@): d Co
s: (EVERYONE@): a rwpRWxDadcs
s: (EVERYONE@): d Co
u:tiaadm: a rwpxo fidi
g: oinstall: a rwpxo fidi
==

Even with the above options implemented, this is what I see:

==
tiaadm:/me01/tia/scripts% chmod 777 /me01/tia/filetrans/DW*
chmod: /me01/tia/filetrans//DW_NUM_OF_ROWS_TSP.txt: Operation not permitted.
==

I find myself absolutely lost & messed up here. Could someone kindly suggest/help getting this sorted?


Cheers,
Souvik
# 2  
Old 06-08-2010
NFSv4 ACLs inheritance flags only work for newly created files and directories, not for existing ones.
# 3  
Old 06-09-2010
Thanks verdepollo for your response..

Well, "Access Control" for the newly created files/directories doesn't work either as I expect them to. I guess, I've messed up the ACL configurations on this directory & its contents, let be elaborate once again for a clear picture:

Step 1:

==
root:/me01/tia/filetrans # ls -lrt DW_NUM_OF_ROWS_TSP.txt
-rwxrwxr-- 1 tiaoas oinstall 43 Jun 07 17:12 DW_NUM_OF_ROWS_TSP.txt
root:/me01/tia/filetrans # acledit DW_NUM_OF_ROWS_TSP.txt
*
* ACL_type AIXC
*
attributes:
base permissions
owner(tiaoas): rwx
group(oinstall): rwx
others: r--
extended permissions
enabled >> Edited from "Disabled" to "Enabled" <<
permit rw- u:tiaadm,g: oinstall >> Added this line for providing r/w permission to 'tiaadm' user for being able to do a chmod <<
==

After this step, user 'tiaadm' was successfully able to do a `chmod 777 /me01/tia/filetrans/DW_NUM_OF_ROWS_TSP.txt`

Step 2:

Configuring ACL for a single file wasn't my exact requirement, rather my requirement was -- user 'tiaadm' should be able to do a 'chmod' to any file(old/new) starting with 'DW' under '/me01/tia/filetrans' directory.
Note: Files with filename starting with 'DW' are created on daily basis by a batch job, hence manually configuring ACL for each of these new files didn't seem to be a right option. So this is what I did next step:

==
aclget DW_NUM_OF_ROWS_TSP.txt | aclput -R /me01/tia/filetrans
==

Here, as mentioned in step 1 - ACL for DW_NUM_OF_ROWS_TSP.txt file was perfect as user 'tiaadm' was able to do a 'chmod', so did a recursive copy of its ACL property to directory /me01/tia/filetrans.
After this step, any new file created under ~/filetrans directory(either by owner of the directory or other user) showed the following ACL property:

==
root:/me01/tia/filetrans # aclget <New File Name>
*
* ACL_type AIXC
*
attributes:
base permissions
owner(tiaoas): rwx
group(oinstall): rwx
others: r--
extended permissions
disabled >> Extended properties showed "disabled" by default <<
==

So, recursive ACL property copy on the directory too didn't help me.

Step 3:

Used "Extended Attribute Format" for inheritance under directories, so this is what I did:

==
root:/ # chfs -a ea=v2 /me01 >> Changed File system to use extended attribute <<
root:/me01/tia # aclconvert -t NFS4 filetrans
root:/me01/tia # acledit filetrans
*
* ACL_type NFS4
*
*
* Owner: tiaesg
* Group: oinstall
*
s: (OWNER@): a rwpRWxDaAdcCs
s: (OWNER@): d o
s: (GROUP@): a rwpRWxDadcs
s: (GROUP@): d Co
s: (EVERYONE@): a rwpRWxDadcs
s: (EVERYONE@): d Co
u:tiaadm: a rwpxo fidi >> Added this line for user 'tiaadm' to be able to do a recursive r/w over files/directories(fidi) <<
g: oinstall: a rwpxo fidi >> Added this line for group 'oinstall' to be able to do a recursive r/w over files/directories(fidi) <<
==

After this step, these are what I see:

* ACL extended permissions for file "DW_NUM_OF_ROWS_TSP.txt" got changed to "disabled" which was set to "enabled" earlier & 'chmod' stopped working(which was earlier working).

* Any new file which got created under ~/filetrans directory, had the following properties:
-- ACL extended permissions set to "disabled" by default.
-- rwx permissions for owner, group & others was 000/--- i.e. didn't have rwx rights to anyone.

Please suggest?

I would like to reiterate my reqd once again -- User 'tiaadm' should be able to do a chmod on all files(old/new) under directory ~/filetrans which has following ownership/permissions:
root:/me01/tia # ls -ld filetrans
drwxrwsr-- tiaoas oinstall 632 Jun 07 17:12 filetrans


Thanks,
Souvik

Last edited by thisissouvik; 06-09-2010 at 02:47 AM..
# 4  
Old 06-09-2010
AIX ACLs (AIXC) does not support inheritance options.

Try this:

Code:
# aclconvert -t NFS4 filetrans
# acledit filetrans

*
* ACL_type NFS4
**
* Owner: tiaesg
* Group: oinstall
*
s:(OWNER@): a rwpRWxDaAdcCo fidi
u:tiaadm: a rwxRAwCc fidioi

# aclget filetrans | aclput -R filetrans

Touch a test file and check that the ACL is active (You'll see a plus sign when running 'ls')

Quick question, are you using at least version 5.3 with JFS2 FS?

Also keep in mind that if you do a chmod 777 to a file, the ACL entry gets overwritten.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

ACL

Can i get the synopsis for add multiple users in single command for ACL access for a directory or a file thanks in advance dinu (3 Replies)
Discussion started by: dinu
3 Replies

2. Web Development

Configuring ACL in Iplanet

Hi Friends, Could any one please help me how to configure access control list (ACL) in Iplanet server in unix mode ? (0 Replies)
Discussion started by: nicky
0 Replies

3. AIX

Configuring /etc/hosts.equiv file in AIX 5.3

Need help in configuring /etc/host.equiv file. Though i configure the /etc/hosts.equiv file to prevent users from connecting remotely to the local server " -host" in /etc/hosts.equiv file, it allows the users to login from remote machine. we don't have .rhosts file on the local server. Could you... (3 Replies)
Discussion started by: saikiran_1984
3 Replies

4. Linux

ACL

Hi, I want to know what does the "effective" comment means in the output of the getfacl and whether it has to do with the acl mask... thanks (0 Replies)
Discussion started by: Gartlar
0 Replies

5. AIX

Configuring AIX with Windows AD

Hey Guys Has anyone out here tried configuring AIX as AD clients for authentication? I have seen redbooks explaining stuffs but has it worked well for anyone? Thanks Bala (1 Reply)
Discussion started by: balaji_prk
1 Replies

6. AIX

Problem:Configuring Apache 2.2.11 in AIX 5.3

Hi All I am new to Apache and AIX and trying to configure Subversion tool in IBM machine with AIX 5.3.Apache is required for client to connect to Subversion Server with http protocol. 1.Installed Apache 2.2.11 and its dependencies via RPM 2.Configured httpd.conf file. 3.Started "httpd"... (1 Reply)
Discussion started by: rajivdp
1 Replies

7. AIX

Configuring new disks on AIX cluster

We run two p5 nodes running AIX 5L in a cluster mode (HACMP), both the nodes share external disk arrays. Only the primary node can access the shared disks at a given point of time. We are in the process of adding two new disks to the disk arrays so as to make them available to the existing... (3 Replies)
Discussion started by: dnicky
3 Replies

8. AIX

Configuring Network Printer in IBM AIX

Hi, We have two IBM pSeires servers running IBM AIX. I want to configure the IBM servers to print on the network printer. Here is the following configuration IBM Server-I IP Add: 192.168.0.5 IBM Server-II IP Add: 192.168.0.6 Network Printer IP Add: 192.168.0.15 I'm new to IBM AIX OS.... (0 Replies)
Discussion started by: berhanemt
0 Replies

9. AIX

Configuring Color Laser ptr in AIX

Hi All, I have Network color laser printer which is to be configured in AIX5L. The Model of the printer is OKI C3200. Will it is supported with AIX 5..? I could not find any drivers for this. Will any compatible drivers are available for this printer... I tried with the default drivers hplj-4... (2 Replies)
Discussion started by: helloajith
2 Replies

10. Cybersecurity

ACL

Hi all, I've just been handled the responsibility for a FTP-site. Having no experiens of UNIX at all. And now one of my users needs to have full access to the usr directory and all it's subdirectories, don't know why just trying to do what the boss tells me. The type of UNIX is FreeBSD and the... (4 Replies)
Discussion started by: -tri-
4 Replies
Login or Register to Ask a Question

Featured Tech Videos