setting ACL's

Thread Tools Search this Thread
Special Forums Cybersecurity setting ACL's
# 1  
Old 07-12-2001
setting ACL's

Hi all,

How can I set default owning user and default owning group with setfacl on Solaris 2.6 and up ?
My idea is, that when a file is created by user x, and the default owning user is y, the ownership is set to y.
This option is visible in the filemanager, though not editable. I can't find anything about it in the man pages or on the SUN webpage.

Can anyone help me out ?


# 2  
Old 07-13-2001
I can't help with GUIs much Smilie but from the command line or a script the command would be chown

You can't normally do this unless you are a priviledged user, right?|
# 3  
Old 07-13-2001

the command for what I would like to accomplish is setfacl, not chown. With chown you can set standard rights for files you own. With setfacl I can give individuals or groups access to my stuff, even when my dirs are set to 700 for example. You can set these as a normal user, but from a maintenance point of view, we want to control them by setting the homedir of users to root, with some ACL's.

# 4  
Old 07-13-2001
Yes, an ACL layer in the kernel /systemuses these functions. Sorry, I was talking more generic. You can do most of what you described in your original post with chown and chmod and don't need complex ACLs.

You said:
My idea is, that when a file is created by user x, and the default owning user is y, the ownership is set to y.
This can be done with an SUID script in the shell and does not require the complexity of ACLs. Most organizations that I have worked with set up ACLs do so at the system call and system object level; not at the user file permissions level. ACLs slow down performance and there needs to be a very compelling to use them.

In your original post, the compelling reason to use lower level ACLs is not obvious to me. That is why I suggested a chown wrapper.

# 5  
Old 07-13-2001

I still think I need ACL's. With the standard chown and chmod commands, I can't set for example secondary groups or specific users to acces a file, or folder. But, my question still not answered is : is it possible to have a user x create a file, which will have the ownership and group rights of the directory it is created in ? example : there is a directory wwwjava, wwwjava is a dummyuseraccount for claiming the UID in NIS. There is also a group wwwjava. In this group are several people. Now, is it possible to have user x, which is in the group wwwjava, to create a file with ownership wwwjava and group wwwjava, instead of the ownership of user x and his primary group ?

# 6  
Old 07-13-2001
Andy asks:

is it possible to have a user x create a file, which will have the ownership and group rights of the directory it is created in ?
Yes, one way to do it is to write a small script (command) that reads the current directory; gets the owner and group information of a file that is an argument to the script. The script may have to be set SUID with ownership root. This is not very secure, but you asked 'is it possible?' The more complex the security requirements, the more involved.

You might also do it any other number of ways, using ACL front ends, perl scripts, a simple C program, etc.

The easiest way to do it, if you are worried about security is to have the administrator with root privs do it Smilie

Or, you can find some complex ACL program; but based on what you have offered as your requirements, this still seems to be a lot of trouble for something quite basic.

If I had a system that had a user or user process creating files I would not want the scripts to have any ability to write or give ownership to the file to another user unless the user was in the same group. If the issue was with many files, I would look at creating a process to do this.

However, without understanding the purpose of the server, the nature of the processes, the relationship of users to the processes, the production environment and security implications and risk; it is not reasonable to give a simplistic answer.

Everything is possible in UNIX and there is no one way to do anything Smilie
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Help setting ACL's

Folks, Solaris 10 issue When I add a new directory to a path, I only get the "group@" line in the ACL The parent directory ACL is drwxrws---+ 12 root teama 12 Jul 18 10:31 . owner@:rwxp-DaARWc---:------:allow group@:rwxp-DaARWc--s:fd----:allow ... (0 Replies)
Discussion started by: wilberforce
0 Replies

2. UNIX for Dummies Questions & Answers

setting up ACL in Apache

Folks; How can i setup ACL in Apache so i can give a group of users (defined by their emails (all users under * access to a web page? (10 Replies)
Discussion started by: moe2266
10 Replies

3. AIX

setting acl

Hi, I want to know how to set acl in aix via smitty and shell prompt, wheather we needs to install additional packages. (0 Replies)
Discussion started by: manoj.solaris
0 Replies

4. Linux

setting acl on linux

Hi, while setting access control list I am getting error "Operation NOt Supported" Example :user A wants full access on test directory /home/user B/test, I dont want to add in secondary group bcz group has read permission, (1 Reply)
Discussion started by: manoj.solaris
1 Replies

5. Shell Programming and Scripting

What are the differences between 'bash' and 'sh'

Hopefully this doesn't come off as too much of a "newbie" question or a flamebait. But I have recently begun working with a Sun Solaris box after having spent the past five years working with RedHat. From what i can tell, thing look fairly similar and the 'man' command is some help. But I've... (7 Replies)
Discussion started by: deckard
7 Replies

6. UNIX for Advanced & Expert Users

How to remove a file with a leading dash '-' in it's name?

Somehow someone created a file named '-ov' in the root directory. Given the name, the how was probably the result of some cpio command they bozo'ed. I've tried a number of different ways to get rid of it using * and ? wildcards, '\' escape patterns etc.. They all fail with " illegal option --... (3 Replies)
Discussion started by: GSalisbury
3 Replies

7. UNIX for Dummies Questions & Answers

quoting echo 'it's friday'

echo 'it's friday' why appear the > (3 Replies)
Discussion started by: yls177
3 Replies

8. UNIX for Dummies Questions & Answers

HELP! The '/var/adm/message' file increase every few seconds???

Hi, guys, I have a big problem. I've got a sun solaris 4.1.4 workstation, and the /var/adm/message file will add one row every few seconds. It becomes a large file in a short time. I wander if there are some mistakes configuring the workstation. the /var/adm/message is as follow: ... (3 Replies)
Discussion started by: cloudsmell
3 Replies

9. Shell Programming and Scripting

Clearify what it means under 'WHAT' when hit the 'w'-command

I wonder how I shall read the result below, especially 'what' shown below. The result was shown when I entered 'w'. E.g what is TOP? What is gosh ( what does selmgr mean?)? login@ idle JCPU PCPU what 6:15am 7:04 39 39 TOP 6:34am 6:45 45 45 TOP 6:41am ... (1 Reply)
Discussion started by: Aelgen
1 Replies

10. Programming

i can't use 'make' in my computer?

I need to compile a file,but 'make' does not work.please tell me how to use it or need which tools? (3 Replies)
Discussion started by: dsun5
3 Replies
Login or Register to Ask a Question