Fine-Tuning Linux Administration with ACLs - Page 2

 By Carla Schroder | Posted Sep 16, 2003
Page 2 of 3   |  Back to Page 1
Print ArticleEmail Article


EAs, or extended attributes, are not part of a file's data, but are instead used to define meta-data (see, now you have a legitimate reason to use this darling new buzzword). Meta-data is simply data that describes other data. It's not the data itself, but rather labels and tags that enable cataloguing and manipulating of the actual data. Obviously, EAs are useful in many ways, not just for ACLs. ACLs are but one type of EA.

EAs are name-value pairs, completely arbitrary and user-defined. Examples include: Version 2; Author Carla; Sekkrit_level 5; Color puce — anything at all that will help you manage your files.

The command setfattr is used to create EAs. getfattr is not a personal comment, but rather a command to display the current EAs of a file. Here is a (rather unimaginative) example:

# setfattr -n Author -v Carla /etc/configfile -n NumericID -v 1001 /etc/configfile
# getfattr -d /etc/configfile

ACLs 101

An Access Control Entry, ACE, is an individual entry in an ACL. setfacl creates an ACL, while getfacl displays one.

# setfacl -m u:fred:rw /etc/configfile
# getfacl /etc/configfile

At a minimum, an ACL must have three attributes: an entry type, either group or user; a groupname or username, or numeric ID; and the access permissions, which are the usual read/write/execute. These three attributes must always be present, and only one of each can be defined per ACL.

Default ACLs can be set on directories so that all files created in the directory will inherit the directory's attributes:

# setfacl -m u:fred:rw,d:u:fred:rw /etc/subdir

Groups can have default attributes:

# cd /home/groupname_shared
# setfacl -m u:fred:rw,d:g:groupname:rw

Man Pages

Help is available at http://acl.bestbits.at/man/man.shtml, and any man pages that are not posted there can be found at http://olympus.het.brown.edu/dwww/. Bless you, Debian persons!

Page 3: Using ACLs Now

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter

By submitting your information, you agree that enterprisenetworkingplanet.com may send you ENTERPRISENetworkingPLANET offers via email, phone and text message, as well as email offers about other products and services that ENTERPRISENetworkingPLANET believes may be of interest to you. ENTERPRISENetworkingPLANET will process your information in accordance with the Quinstreet Privacy Policy.