Fine-Tuning Linux Administration with ACLs - Page 2

 By Carla Schroder
Page 2 of 3   |  Back to Page 1
Print Article


EAs, or extended attributes, are not part of a file's data, but are instead used to define meta-data (see, now you have a legitimate reason to use this darling new buzzword). Meta-data is simply data that describes other data. It's not the data itself, but rather labels and tags that enable cataloguing and manipulating of the actual data. Obviously, EAs are useful in many ways, not just for ACLs. ACLs are but one type of EA.

EAs are name-value pairs, completely arbitrary and user-defined. Examples include: Version 2; Author Carla; Sekkrit_level 5; Color puce — anything at all that will help you manage your files.

The command setfattr is used to create EAs. getfattr is not a personal comment, but rather a command to display the current EAs of a file. Here is a (rather unimaginative) example:

# setfattr -n Author -v Carla /etc/configfile -n NumericID -v 1001 /etc/configfile
# getfattr -d /etc/configfile

ACLs 101

An Access Control Entry, ACE, is an individual entry in an ACL. setfacl creates an ACL, while getfacl displays one.

# setfacl -m u:fred:rw /etc/configfile
# getfacl /etc/configfile

At a minimum, an ACL must have three attributes: an entry type, either group or user; a groupname or username, or numeric ID; and the access permissions, which are the usual read/write/execute. These three attributes must always be present, and only one of each can be defined per ACL.

Default ACLs can be set on directories so that all files created in the directory will inherit the directory's attributes:

# setfacl -m u:fred:rw,d:u:fred:rw /etc/subdir

Groups can have default attributes:

# cd /home/groupname_shared
# setfacl -m u:fred:rw,d:g:groupname:rw

Man Pages

Help is available at http://acl.bestbits.at/man/man.shtml, and any man pages that are not posted there can be found at http://olympus.het.brown.edu/dwww/. Bless you, Debian persons!

Page 3: Using ACLs Now

This article was originally published on Sep 16, 2003
Get the Latest Scoop with Networking Update Newsletter