هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.
ماذا يفعل
Normal permissions have one owner and one group. With setfacl you add more: u:carol:rx for a user, g:account:rwx for a group. A default ACL (-d) on a directory is copied to new files and directories in it.
The mask is the maximum for all named users and groups and the owning group. setfacl sets it automatically; chmod g=... on a file with an ACL changes the mask.
Only the owner or root may change an ACL. XFS and ext4 on RHEL support ACLs without extra mount options.
طريقة الكتابة
setfacl [-bkndRLPvh] [{-m|-x} ACL] [{-M|-X} FILE] FILE...
setfacl --set=ACL FILE...
setfacl --restore=FILEالأجزاء الرئيسية
u:USER:PERMS- Rights for a named user (u::PERMS = the owner).
g:GROUP:PERMS- Rights for a named group (g::PERMS = the owning group).
m::PERMS- The mask.
o::PERMS- Others.
d:ENTRY- A default entry (same as -d).
PERMS- r, w, x, X (x only for folders) or - ; numbers 0–7 work too.
الخيارات 18
الأكثر استخدامًا
--restore=FILE- Restore ACLs from a
getfacl -Rdump.
لا يوجد شيء يطابق هذا الفلتر.
أمثلة 11
$ مستخدم عادي# بصلاحية root (أو مع sudo)
1Give one user read access
setfacl -m u:carol:r report.txtcarol may read; the normal mode stays.
2Give a group full access to a folder
setfacl -m g:account:rwx /srv/salesA second team without changing the owning group.
3Make new files inherit the rights
setfacl -d -m g:account:rwX /srv/salesWithout -d only existing entries change.
4Existing files and new files together
setfacl -R -m g:account:rX /srv/sales setfacl -d -m g:account:rX /srv/salesFirst the tree, then the default for later files.
5Remove one entry
setfacl -x u:carol report.txtOnly carol's entry goes.
6Remove all ACLs
setfacl -R -b /srv/salesBack to the normal permissions.
7Let a service read a log folder
setfacl -R -m u:promtail:rX /var/log/httpd setfacl -d -m u:promtail:rX /var/log/httpdA log shipper reads logs without being root or in the group (least privilege).
8Let a user only pass through a folder
setfacl -m u:carol:x /home/lisacarol can reach a file inside (if she may read it) but cannot list the folder.
9Test before you change
setfacl --test -m u:carol:rw report.txtShows the new ACL only.
10Restore a backup of ACLs
setfacl --restore=/root/srv-acl.txtThe dump from
getfacl -R.11Fix rights cut by the mask
setfacl -m m::rwx /srv/sales/plan.txtThe mask limits named entries; set it back to rwx.
لا يوجد شيء يطابق هذا الفلتر.
انتبه
- The mask limits named users and groups. Check
#effective:in getfacl. - A default ACL on a folder replaces the umask for new files there.
- Backups need ACL support:
tar --acls,rsync -A.
رموز الخروج
0 :: Done. 1 :: Error.