default acls on directory and files
Ralf Gross
I still have some trouble with acls.
If I set the default acl on a directory for a user to r-x, all
directories created in that directory gets the same permissions r-x.
That's fine. But files in that directory get r-x permission too, how can
I achieve that only new created directories get r-x permissions and new
files get r-- permissions by default.
setfacl -m d:u:blah:r-x directory
touch directory/test.txt
getfacl directoty/test.txt
...
user:blah:r-x
...
Ralf
Peter C. Tribble
What's the real output from getfacl? The output from getfacl doesn't
look like what you show above.
If you look at getfacl, it will show you both the ACL, which should be
r-x becasue that's what you told it to do, and it should also show you
the permissions, like so:
user:blah:r-x #effective:r--
which shows that the permissions really are r--.
--
-Peter Tribble
MRC Rosalind Franklin Centre for Genomics Research
http://www.rfcgr.mrc.ac.uk/~ptribble/
Ralf Gross
>>
>> I still have some trouble with acls.
>>
>> If I set the default acl on a directory for a user to r-x, all
>> directories created in that directory gets the same permissions r-x.
>> That's fine. But files in that directory get r-x permission too, how can
>> I achieve that only new created directories get r-x permissions and new
>> files get r-- permissions by default.
>>
>> setfacl -m d:u:blah:r-x directory
>>
>> touch directory/test.txt
>>
>> getfacl directoty/test.txt
>> ...
>> user:blah:r-x
>> ...
>
> What's the real output from getfacl? The output from getfacl doesn't
> look like what you show above.
>
> If you look at getfacl, it will show you both the ACL, which should be
> r-x becasue that's what you told it to do, and it should also show you
> the permissions, like so:
>
> user:blah:r-x #effective:r--
>
> which shows that the permissions really are r--.
Directory:
# file: .
# owner: rg
# group: radar
user::rwx
user:blah:r-x #effective:r-x
group::rwx #effective:rwx
mask:rwx
other:---
default:user::rwx
default:user:blah:r-x
default:group::rwx
default:mask:rwx
default:other:---
File:
# file: test.txt
# owner: rg
# group: radar
user::rw-
user:blah:r-x #effective:r-x
group::rw- #effective:rw-
mask:rwx
other:---
I did the following:
find directory/ -type d -exec setfacl -s user::rwx,group::---,
mask:rwx,other:---,default:user::rwx,default:group::rwx,
default:mask:rwx,default:other:--- {} \;
find directory/ -type d -exec setfacl -m d:u:blah:r-x {} \;
find directory/ -type f -exec setfacl -m user:blah:r-- {} \;
The r-x as default permissions on directories is neccessary because the
user should have access to all subdirectories.
Ralf
Peter C. Tribble
Ralf Gross <use...@ralfgross.de> writes:
> Peter C. Tribble wrote:
>>>
>>> I still have some trouble with acls.
> Directory:
>
> # file: .
> # owner: rg
> # group: radar
> user::rwx
> user:blah:r-x #effective:r-x
> group::rwx #effective:rwx
> mask:rwx
> other:---
> default:user::rwx
> default:user:blah:r-x
> default:group::rwx
> default:mask:rwx
> default:other:---
>
> File:
>
> # file: test.txt
> # owner: rg
> # group: radar
> user::rw-
> user:blah:r-x #effective:r-x
> group::rw- #effective:rw-
> mask:rwx
> other:---
How did you create this file? It's obviously had its permissions or ACL
changed, because they aren't compatible with the default ACL you
show. (Note that the default ACL simply specifies what the initial
values are at creation time, and has no influence on later behaviour.)
Specifically, the user:: and group:: entries have had the x bit taken
off, but the mask hasn't. So something has fiddled with the mask since
the file was created.
The state of the x bit is normally handled separately. Tools know to
create executables and directories with execute on, and regular files
with execute off.
(What version of Solaris are you using, by the way?
> I did the following:
>
> find directory/ -type d -exec setfacl -s user::rwx,group::---,
> mask:rwx,other:---,default:user::rwx,default:group::rwx,
> default:mask:rwx,default:other:--- {} \;
>
> find directory/ -type d -exec setfacl -m d:u:blah:r-x {} \;
>
> find directory/ -type f -exec setfacl -m user:blah:r-- {} \;
Obviously not before the getfacl above. You might have run it since.
You can combine the first 2 into 1.
And the second might to have been "-m mask:rw-"
> The r-x as default permissions on directories is neccessary because the
> user should have access to all subdirectories.
Indeed. We use ACLs for exactly this purpose (usually with the setgid
bit set on the directories as well).
Ralf Gross
Please see below, I made a chmod after applying the acls *grrr*
> Specifically, the user:: and group:: entries have had the x bit taken
> off, but the mask hasn't. So something has fiddled with the mask since
> the file was created.
> The state of the x bit is normally handled separately. Tools know to
> create executables and directories with execute on, and regular files
> with execute off.
The directory is asamba share, if I just touch a file it gets r--
permissions, but if I create the file with samba, it gets r-x
permissions.
The config for the share:
[Radar]
printable = no
comment = Projekte-Bereich Radar
browseable = no
writable = yes
force create mode = 0660
create mask = 0660
force directory mode = 2770
directory security mask = 2770
force directory security mode = 0000
directory mask = 2770
force security mode = 0000
security mask = 0770
force group = +radar
path = /projekte/Radar
valid users = +radar, blah
I can't see, why the x bit should interact with this config.
> (What version of Solaris are you using, by the way?
2.8/Sparc.
>> I did the following:
>>
>> find directory/ -type d -exec setfacl -s user::rwx,group::---,
>> mask:rwx,other:---,default:user::rwx,default:group::rwx,
>> default:mask:rwx,default:other:--- {} \;
I made a mistake. I want that owner and group have rwx permissions on
directories and rw- on files. If I set the acls like above I get the
wrong permissions:
drwx--S--- 12 mf radar 512 Nov 17 14:02 .
I remember that I did a chmod g+rwx on the directory tree yesterday
evening to correct that...
This should be the right way:
setfacl -m user::rwx,group::rwx,mask:rwx,other:---,default:user::rwx,
default:group::rwx,default:mask:rwx,default:other:--- .
And it seems to be ok.
# file: .
# owner: mf
# group: radar
user::rwx
user:blah:r-x #effective:r-x
group::rwx #effective:rwx
mask:rwx
other:---
default:user::rwx
default:user:blah:r-x
default:group::rwx
default:mask:rwx
default:other:---
drwxrws--- 12 mf radar 512 Nov 17 14:02 .
But If I create a new directory, the x bit is not set.
drwxr-s--- 2 root radar 512 Nov 17 14:02 test
The default mask for group is set to rwx, why does the new directory
just get r-x (r-s) permissions. I'm confused.
Directories should have rwx permissions for user and group (+setgid bit)
and files should have rw- permissions for user and group. Furthermore I
want the named user blah to have r-x perms on directories and r--
permissions on files.
find . -type d -exec setfacl -m user::rwx,group::rwx,mask:rwx,other:---,
default:user::rwx,default:group::rwx,default:mask:rwx,default:other:---
{} \;
doesn'T set the permissions right, new created directories just get
drwxr-s--- permissions.
Any idea whats's wrong?
>> find directory/ -type d -exec setfacl -m d:u:blah:r-x {} \;
>>
>> find directory/ -type f -exec setfacl -m user:blah:r-- {} \;
>
> Obviously not before the getfacl above. You might have run it since.
No, this was the first step. Set the default acls and the desired acls
on existing files. Then I checked what happens with new created
directories and files.
> You can combine the first 2 into 1.
Yes, I just wanted to do this step by step.
> And the second might to have been "-m mask:rw-"
Hm, I'm not sure if I understand this...
>> The r-x as default permissions on directories is neccessary because the
>> user should have access to all subdirectories.
>
> Indeed. We use ACLs for exactly this purpose (usually with the setgid
> bit set on the directories as well).
That's the way I handle project shares usually. Create a new group with
all the members in it. Create a share with 2770 permissions.
Ralf
Peter C. Tribble
Ralf Gross <use...@ralfgross.de> writes:
>
> The directory is asamba share, if I just touch a file it gets r--
> permissions, but if I create the file with samba, it gets r-x
> permissions.
I have to say that we've also had problems on our samba shares. The
ACLs work, but then something (samba? or the windows client?) starts
hacking at the permissions and then all bets are off.
> The config for the share:
...
> I can't see, why the x bit should interact with this config.
Neither can I. (Not that I would expect to, though, as I'm not that
familiar with samba.)
>> (What version of Solaris are you using, by the way?
>
> 2.8/Sparc.
Should be OK. We're running that (and 9 and 10).
> setfacl -m user::rwx,group::rwx,mask:rwx,other:---,default:user::rwx,
> default:group::rwx,default:mask:rwx,default:other:--- .
>
> And it seems to be ok.
>
> # file: .
> # owner: mf
> # group: radar
> user::rwx
> user:blah:r-x #effective:r-x
> group::rwx #effective:rwx
> mask:rwx
> other:---
> default:user::rwx
> default:user:blah:r-x
> default:group::rwx
> default:mask:rwx
> default:other:---
>
> drwxrws--- 12 mf radar 512 Nov 17 14:02 .
>
> But If I create a new directory, the x bit is not set.
>
> drwxr-s--- 2 root radar 512 Nov 17 14:02 test
>
> The default mask for group is set to rwx, why does the new directory
> just get r-x (r-s) permissions. I'm confused.
What ls are you using? I don't see any + signs...
(Which there pretty well should be there if the files have ACLs on them.)
(Actually, in the presence of ACLs you can't necessarily trust the
permissions from ls, you sometimes need to look at the actual ACL.)
Ralf Gross
> In article <slrncpmm4n...@pirx.askja.de>,
> Ralf Gross <use...@ralfgross.de> writes:
>>
>> The directory is asamba share, if I just touch a file it gets r--
>> permissions, but if I create the file with samba, it gets r-x
>> permissions.
>
> I have to say that we've also had problems on our samba shares. The
> ACLs work, but then something (samba? or the windows client?) starts
> hacking at the permissions and then all bets are off.
That was not what I wanted to hear ;)
>> [snip]
>> But If I create a new directory, the x bit is not set.
>>
>> drwxr-s--- 2 root radar 512 Nov 17 14:02 test
>>
>> The default mask for group is set to rwx, why does the new directory
>> just get r-x (r-s) permissions. I'm confused.
>
> What ls are you using? I don't see any + signs...
> (Which there pretty well should be there if the files have ACLs on them.)
That's because I've done the ls as root user. As unprivileged user I can
see the + sign. I discoverd that behaviour a while ago.
drwxr-s---+ 2 root radar 512 Nov 17 14:55 test
> (Actually, in the presence of ACLs you can't necessarily trust the
> permissions from ls, you sometimes need to look at the actual ACL.)
getfacl shows the same permissions.
# file: test/
# owner: root <<<<--------- problem?
# group: radar
user::rwx
user:blah:r-x #effective:r-x
group::r-x #effective:r-x
mask:r-x
other:---
default:user::rwx
default:user:blah:r-x
default:group::rwx
default:mask:rwx
default:other:---
Ok, I see the problem. If I create the directory as root, it gets
permissions like above. If I create the directory as user rg they look
perfect.
drwxrws---+ 2 rg radar 512 Nov 17 17:20 test
Something basic I missing there?
Now there is just the samba problem left. Permissions for user blah on a
new file is still r-x. Maybe I will open a thread in the samba group.
Thanks, Ralf