Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
Wat het doet
Normal permissions have one owner and one group. With setfacl you add more: u:carol:rx for a user, g:account:rwx for a group. A default ACL (-d) on a directory is copied to new files and directories in it.
The mask is the maximum for all named users and groups and the owning group. setfacl sets it automatically; chmod g=... on a file with an ACL changes the mask.
Only the owner or root may change an ACL. XFS and ext4 on RHEL support ACLs without extra mount options.
Zo schrijf je het
setfacl [-bkndRLPvh] [{-m|-x} ACL] [{-M|-X} FILE] FILE...
setfacl --set=ACL FILE...
setfacl --restore=FILEBelangrijkste delen
u:USER:PERMS- Rights for a named user (u::PERMS = the owner).
g:GROUP:PERMS- Rights for a named group (g::PERMS = the owning group).
m::PERMS- The mask.
o::PERMS- Others.
d:ENTRY- A default entry (same as -d).
PERMS- r, w, x, X (x only for folders) or - ; numbers 0–7 work too.
Opties 18
Meest gebruikt
--restore=FILE- Restore ACLs from a
getfacl -Rdump.
Niets past bij dit filter.
Voorbeelden 11
$ als gewone gebruiker# als root (of met sudo)
1Give one user read access
setfacl -m u:carol:r report.txtcarol may read; the normal mode stays.
2Give a group full access to a folder
setfacl -m g:account:rwx /srv/salesA second team without changing the owning group.
3Make new files inherit the rights
setfacl -d -m g:account:rwX /srv/salesWithout -d only existing entries change.
4Existing files and new files together
setfacl -R -m g:account:rX /srv/sales setfacl -d -m g:account:rX /srv/salesFirst the tree, then the default for later files.
5Remove one entry
setfacl -x u:carol report.txtOnly carol's entry goes.
6Remove all ACLs
setfacl -R -b /srv/salesBack to the normal permissions.
7Let a service read a log folder
setfacl -R -m u:promtail:rX /var/log/httpd setfacl -d -m u:promtail:rX /var/log/httpdA log shipper reads logs without being root or in the group (least privilege).
8Let a user only pass through a folder
setfacl -m u:carol:x /home/lisacarol can reach a file inside (if she may read it) but cannot list the folder.
9Test before you change
setfacl --test -m u:carol:rw report.txtShows the new ACL only.
10Restore a backup of ACLs
setfacl --restore=/root/srv-acl.txtThe dump from
getfacl -R.11Fix rights cut by the mask
setfacl -m m::rwx /srv/sales/plan.txtThe mask limits named entries; set it back to rwx.
Niets past bij dit filter.
Let op
- The mask limits named users and groups. Check
#effective:in getfacl. - A default ACL on a folder replaces the umask for new files there.
- Backups need ACL support:
tar --acls,rsync -A.
Exitcodes
0 | Done. |
1 | Error. |