Access control lists (ACLs) Linux

Introduction to the management of ACLs (Access Control List) on Linux

Access control list (ACL) provides an additional, more flexible permission mechanism for file systems. It is designed to assist with UNIX file permissions. ACL allows you to give permissions for any user or group to any disc resource.

Think of a scenario in which a particular user is not a member of group created by you but still you want to give some read or write access, how can you do it without making user a member of group, here comes in picture Access Control Lists, ACL helps us to do this trick.

Basically, ACLs are used to make a flexible permission mechanism in Linux.

Installing ACL:

Before using ACLs for a file or directory, install the acl package:

Redhat: yum install acl

SUSE: zypper install acl

ubuntu: apt-get install acl

Know when a file has ACL attached to it:

It is very easy to know when a file has attached ACL to it. ls -ld command would produce a output as shown below.

Note the + sign at the end of the permissions. This confirms that the file has an ACL attached to it.

getfacl : Display ACL information details of a file.

# getfacl /meetdarji

The mask field here only applies to the additional permissions we have given to the user and groups. If the mask is set to rwx the read, write and execute permissions will be granted to additional user/groups. If the mask is set to r-x, the write permission will not be granted to additional user/groups.In general, DO NOT set mask to anything other than rwx. The mask value doe not affect the standard UNIX user/group/others permissions.

File with no ACLs

If you run the getfacl command on a file with no ACLs the additional “user:” lines and “mask” line will not be shown and standard file permissions will be shown.

The setfacl command is used to set ACL on the given file. To give a rwx access to user "meet" on the file /meetdarji :

# setfacl -m u:meet:rwx /meetdarji

The -m option tells setfacl to modify ACLs on the file(s) mentioned in command line.To give a rwx access to group "darji" on the file /meetdarji :

# setfacl -m g:darji:rwx /meetdarji

ACLs for multiple user and groups can also be set with single command :

# setfacl -m u:meet:rwx,g:darji:r-x /meetdarji

Removing ACLs

To remove ACL, use the setfacl command with -x option :

# setfacl -x u:meet /meetdarji

The above command removes the ACL for the user john on the file /meetdarji. The ACLs for other user/groups if any remains unaffected.

To remove all ACLs associated to a file use the -b option with setfacl :

# setfacl -b /meetdarji

Backup and Restore ACLs permission

# cd (/meetdarji -> (backup of file path) 

# getfacl -R * > bkp_acl.txt  ( -R -> recursive )

Restoring the ACLs

When you restore the files in /meetdarji directory, you would have to restore the ACLs associated with the files in that direcotry. TO do that use the ACL backup file bkp_acl.txt along with the –restore option :

# setfacl --restore=bkp_acl.txt

Lastly, I hope it's helpful. So, let me know your suggestions and feedback using the comment section.