Fine-Tuning Linux Administration with ACLs - Page 2
Terminology
EAs, or extended attributes, are not part of a file's data, but are instead used to define meta-data (see, now you have a legitimate reason to use this darling new buzzword). Meta-data is simply data that describes other data. It's not the data itself, but rather labels and tags that enable cataloguing and manipulating of the actual data. Obviously, EAs are useful in many ways, not just for ACLs. ACLs are but one type of EA.
EAs are name-value pairs, completely arbitrary and user-defined. Examples include: Version 2; Author Carla; Sekkrit_level 5; Color puce — anything at all that will help you manage your files.
The command setfattr is used to create EAs. getfattr is not a personal comment, but rather a command to display the current EAs of a file. Here is a (rather unimaginative) example:
# setfattr -n Author -v Carla /etc/configfile -n NumericID -v 1001 /etc/configfile
# getfattr -d /etc/configfile
ACLs 101
An Access Control Entry, ACE, is an individual entry in an ACL. setfacl creates an ACL, while getfacl displays one.
# setfacl -m u:fred:rw /etc/configfile
# getfacl /etc/configfile
At a minimum, an ACL must have three attributes: an entry type, either group or user; a groupname or username, or numeric ID; and the access permissions, which are the usual read/write/execute. These three attributes must always be present, and only one of each can be defined per ACL.
Default ACLs can be set on directories so that all files created in the directory will inherit the directory's attributes:
# setfacl -m u:fred:rw,d:u:fred:rw /etc/subdir
Groups can have default attributes:
# cd /home/groupname_shared
# setfacl -m u:fred:rw,d:g:groupname:rw
Man Pages
Help is available at http://acl.bestbits.at/man/man.shtml, and any man pages that are not posted there can be found at http://olympus.het.brown.edu/dwww/. Bless you, Debian persons!
