Lab 7.2: Defaults, ACLs and fixing access problems

Goal

Set safer default permissions, give one extra group access with an ACL, protect a file, and fix a broken access path.

Before you start

Finish lab 7.1 first. Work on server1 as root unless a task says otherwise.

Tasks

For user anna only, new files must get 640 and new folders 750.
Members of account must be able to read (not change) everything in /data/sales, also files that are created later.
User carol (not in any team) must be able to read /data/sales/bob.txt only.
Make /data/sales/bob.txt immutable, try to delete it as root, then remove the protection again.
Run chmod 700 /data (a "mistake"). As anna, try to open /data/sales. Find the cause with namei -l and fix it so that the team folders work again and others still cannot list /data.

Check your work

#su - anna -c 'umask; touch /tmp/x1; mkdir /tmp/x2; ls -ld /tmp/x1 /tmp/x2'
#getfacl /data/sales
#su - bob -c 'echo test > /data/sales/new.txt'; getfacl /data/sales/new.txt
#su - carol -c 'cat /data/sales/bob.txt'
#ls -ld /data; lsattr /data/sales/bob.txt

anna: umask 0027, file -rw-r-----, folder drwxr-x---.
/data/sales has group:account:r-x and default:group:account:r-x; new.txt has group:account:r-- (effective).
carol can read bob.txt.
/data is drwx--x--x (or 711); bob.txt has no i attribute.

Hints

Show the hints

One user: ~/.bashrc. All users: /etc/profile.d/.
Default ACL: setfacl -d -m. Use rX so folders get x and files do not.
carol needs x on /data/sales to reach the file, and r on the file. setfacl -m u:carol:x on the folder is enough for the path.
chmod 711 /data lets everybody pass through without listing.

Solution

Show the solution

umask for anna.
```
#echo "umask 027" >> /home/anna/.bashrc
```

Normal and default ACL for the group account.

#setfacl -R -m g:account:rX /data/sales
#setfacl -d -m g:account:rX /data/sales

Path and file for carol.

#setfacl -m u:carol:x /data/sales
#setfacl -m u:carol:r /data/sales/bob.txt

Immutable test.

#chattr +i /data/sales/bob.txt
#rm -f /data/sales/bob.txt
rm: cannot remove '/data/sales/bob.txt': Operation not permitted
#chattr -i /data/sales/bob.txt

Find and fix the path problem.

#chmod 700 /data
#su - anna -c 'namei -l /data/sales'
#chmod 711 /data

My notes

No notes yet.

Defaults, ACLs and fixing access problems