Filesystem options and commands
First check to make sure the file system is mounted with acl settings
cat /proc/mounts |grep acl
/dev/sda1 / ext3 rw,noatime,relatime,errors=remount-ro,acl,data=ordered 0 0
If not update /etc/fstab and add 'acl' to the options section and remount the file system
getfacl, setfacl, chacl are the two main commands. chacl is available for IRIX compatibility.
Use Cases
Grant 2 users permissions to the same directory and files under it
Let's say we want to grant user john and mary permissions to folder /var/www/mysite.com
We can start by creating the directory. At this point we can leave it owned by root as the ACLs will help here.
ls -ld /var/www/mysite.com/
drwxr-xr-x 2 root root 4096 Feb 11 15:21 /var/www/mysite.com/
The first 2 commands grant users john and mary permissions.
The second sets the default acl. This causes the acls to be applied with inhertiance set. So this makes good sense in a multi user multi edit environment. The next arguments between the : are the username and the permissions
setfacl -m john:rwx mysite.com
setfacl -m mary:rwx mysite.com
setfacl -m default:john:rwx mysite.com
setfacl -m default:mary:rwx mysite.com
# file: mysite.com
# owner: root
# group: root
user::rwx
user:john:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:john:rwx
default:user:mary:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
Now create a file by logging in a user john.
john@slice01$ echo "john" > file1
john@slice01$ ls -l file1
-rw-rw-r--+ 1 john john 4 Feb 11 15:31 file1
john@slice01$ getfacl file1
# file: file1
# owner: john
# group: john
user::rw-
user:john:rwx #effective:rw-
user:mary:rwx #effective:rw-
group::r-x #effective:r--
mask::rw-
other::r--
Then create a directory
john@slice01$ mkdir john
john@slice01$ getfacl john
# file: john
# owner: john
# group: john
user::rwx
user:john:rwx
user:mary:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:john:rwx
default:user:mary:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
As you can see mary is there in the ACLs also
You can test it by logging in as user mary & editing files created by john.
mary@slice01$ echo mary >> file1
mary@slice01$ cat file1
john
mary
mary@slice01$ cd john/
mary@slice01 $ echo mary > file2
mary@slice01 $ getfacl file2
# file: file2
# owner: mary
# group: mary
user::rw-
user:john:rwx #effective:rw-
user:mary:rwx #effective:rw-
group::r-x #effective:r--
mask::rw-
other::r--
Grant 2 users permissions to the same directory and files under it except to 2 individual directories
Lets say we want john and mary to have permissions under /var/www/mysite.com/ and all files but still have individual directories
/var/www/mysite.com/john & /var/www/mysite.com/mary
getfacl mary
# file: mary
# owner: mary
# group: mary
user::rwx
user:john:rwx
user:mary:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:john:rwx
default:user:mary:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
The -k switch removes the default acls
setfacl -k mary
getfacl mary
# file: mary
# owner: mary
# group: mary
user::rwx
user:john:rwx
user:mary:rwx
group::r-x
mask::rwx
other::r-x
Then remove john from it also
setfacl -x john mary
getfacl mary
# file: mary
# owner: mary
# group: mary
user::rwx
user:mary:rwx
group::r-x
mask::rwx
other::r-x
Repeat the same with other folder
