setfaclGrant per-user and per-group access with ACLs
setfacl adds Access Control List entries to a file or directory: give one extra user or group read or write access without changing the owner, the group or 'others'. Default ACLs on a directory make new files inherit those rights automatically.
setfacl [-R] [-d] {-m|-x} ENTRY[,ENTRY]... FILE... | setfacl -b FILEpriya (on-call) must read /srv/app/logs, which belongs to deploy:deploy with no access for others. Don't change the owner or group.
sudoOnly the file's owner or root may change its ACL.
POSIX ACLs are stored as extended attributes: system.posix_acl_access for the file's own ACL and, on directories, system.posix_acl_default for the ACL that new children inherit. setfacl writes them with setxattr; ext4, XFS and btrfs support them by default. An ACL always contains the base entries user::, group:: and other:: (the classic mode bits) and, once you add named entries, a mask:: entry. On access the kernel checks in order: owner; then named user entries; then the owning group and named group entries (any one granting the request is enough); then other. Every named user and every group entry is capped by the mask, which is shown as the group triplet in ls -l, so chmod g-w lowers the mask and silently reduces those entries' effective rights. setfacl recalculates the mask to cover all entries unless you pass -n. Files with ACLs get a + after the mode in ls -l. When a directory has a default ACL, new files get it (and the umask is ignored for them).
The kernel walks the ACL in a fixed order: owner, named users, groups, other, and every named or group entry is capped by the mask.
priya (uid 1001) is not the owner and not in group deploy. Without an ACL she'd get the other bits: nothing.
-m ENTRYAdd or modify entries (u:name:rwx, g:name:rx, m::rx, o::r)-x ENTRYRemove entries (u:name, g:name)-bRemove all extended entries (back to plain mode bits)-kRemove the default ACL-dOperate on the default ACL (inherited by new files)-RRecursive-nDon't recalculate the mask-M FILE / --restore=FILEApply entries from a file / restore a getfacl -R dump--testShow the resulting ACLs without changing anythingRunning chmod g-w or chmod 640 on a file with ACLs to 'tighten the group'On an ACL'd file the group bits are the mask, so you also cut every named user and group entry.
Change the owning group's entry with setfacl -m g::r FILE, and check getfacl for #effectiveGiving access to the file but not the parent directoriesReaching a file needs x on every directory in its path for that user.
setfacl -m u:priya:x /srv /srv/app (or rx), or check with namei -l PATHSetting only an access ACL on a directory and expecting new files to inherit itInheritance comes from the default ACL (-d), which is separate.
setfacl -m g:team:rwX DIR && setfacl -d -m g:team:rwX DIRBacking up or copying with plain cp, tar or rsync and losing access after restoreACLs are extended attributes; those tools skip them by default.
cp -a, tar --acls --xattrs, rsync -aAX, or save with getfacl -RTry these on a Linux machine of your own. Each task has a hint and a solution.
Create ~/data/shared.txt with mode 600 and give the user www-data read access via an ACL. Show the ACL.
Give www-data traverse access to ~/data and your home so it can actually reach the file. Test with sudo -u.
Set a default ACL on ~/data so every new file gives the adm group read access. Create a file and verify.
Remove all ACLs from ~/data/shared.txt and confirm the + is gone.
setfaclGrant per-user and per-group access with ACLs
setfacl adds Access Control List entries to a file or directory: give one extra user or group read or write access without changing the owner, the group or 'others'. Default ACLs on a directory make new files inherit those rights automatically.
setfacl [-R] [-d] {-m|-x} ENTRY[,ENTRY]... FILE... | setfacl -b FILEpriya (on-call) must read /srv/app/logs, which belongs to deploy:deploy with no access for others. Don't change the owner or group.
sudoOnly the file's owner or root may change its ACL.
POSIX ACLs are stored as extended attributes: system.posix_acl_access for the file's own ACL and, on directories, system.posix_acl_default for the ACL that new children inherit. setfacl writes them with setxattr; ext4, XFS and btrfs support them by default. An ACL always contains the base entries user::, group:: and other:: (the classic mode bits) and, once you add named entries, a mask:: entry. On access the kernel checks in order: owner; then named user entries; then the owning group and named group entries (any one granting the request is enough); then other. Every named user and every group entry is capped by the mask, which is shown as the group triplet in ls -l, so chmod g-w lowers the mask and silently reduces those entries' effective rights. setfacl recalculates the mask to cover all entries unless you pass -n. Files with ACLs get a + after the mode in ls -l. When a directory has a default ACL, new files get it (and the umask is ignored for them).
The kernel walks the ACL in a fixed order: owner, named users, groups, other, and every named or group entry is capped by the mask.
priya (uid 1001) is not the owner and not in group deploy. Without an ACL she'd get the other bits: nothing.
-m ENTRYAdd or modify entries (u:name:rwx, g:name:rx, m::rx, o::r)-x ENTRYRemove entries (u:name, g:name)-bRemove all extended entries (back to plain mode bits)-kRemove the default ACL-dOperate on the default ACL (inherited by new files)-RRecursive-nDon't recalculate the mask-M FILE / --restore=FILEApply entries from a file / restore a getfacl -R dump--testShow the resulting ACLs without changing anythingRunning chmod g-w or chmod 640 on a file with ACLs to 'tighten the group'On an ACL'd file the group bits are the mask, so you also cut every named user and group entry.
Change the owning group's entry with setfacl -m g::r FILE, and check getfacl for #effectiveGiving access to the file but not the parent directoriesReaching a file needs x on every directory in its path for that user.
setfacl -m u:priya:x /srv /srv/app (or rx), or check with namei -l PATHSetting only an access ACL on a directory and expecting new files to inherit itInheritance comes from the default ACL (-d), which is separate.
setfacl -m g:team:rwX DIR && setfacl -d -m g:team:rwX DIRBacking up or copying with plain cp, tar or rsync and losing access after restoreACLs are extended attributes; those tools skip them by default.
cp -a, tar --acls --xattrs, rsync -aAX, or save with getfacl -RTry these on a Linux machine of your own. Each task has a hint and a solution.
Create ~/data/shared.txt with mode 600 and give the user www-data read access via an ACL. Show the ACL.
Give www-data traverse access to ~/data and your home so it can actually reach the file. Test with sudo -u.
Set a default ACL on ~/data so every new file gives the adm group read access. Create a file and verify.
Remove all ACLs from ~/data/shared.txt and confirm the + is gone.