Introduction
What are ACLs?
ACLs versus Traditional Permissions
ACLs though powerful add additional complexity to the system and do have some limitations discussed further down this article. You will notice throughout the Bonsai Framework we add ACLs only when absolutely necessary.
Limitations
Support in Utilities - For example, the version of GNU tar packaged with the OS may not back up or restore ACLs.
Standardizing Across Operating Systems - Moving files with ACLs between operating systems that both support ACLs may not work.
Move - Moving a file created outside of an ACL directory into an ACL directory will not result in inheritance of permissions. (even with defaults set)
Backup - The most used backup command in *nix, tar, does not support ACLs unless modified. Some distributions like redhat have this built into tar. Otherwise your options are to use star or manually backup and restore the ACLs. Options are covered in this article.
Copying Files - This is no-longer an issue with modern (2012 is when I checked) versions of Ubuntu and I would guess other *nix systems. If you want to preserve specific ACL permissions and not inherit, use -p. With an older system, check that when setting default ACLs on a directory, the following commands will inherit permissions properly: local copy, sftp remote create and sftp remote copy.
SFTP - copy/create will inherit ACLs, but move from outside needs to be tested.
Creating Users and Groups
sudo --gid 3100 wgdailyplanet sudo --gid 3101 wglexcorp sudo useradd -d /opt/web/php/ckent -m -g wgdailyplanet -u 4001 -c "Clark Kent" -s /bin/bash ckent sudo useradd -d /opt/web/php/lluthor -m -g wglexcorp -u 4006 -c "Lex Luthor" -s /bin/bash lluthor
ACLs and Groups
The most scalable way to use ACLs is to apply groups. A tutorial approach will be used to illustrate the commands.
The scenario is we want to provide website hosting for two different wgdailyplanets who we will start by categorizing into two different groups,
User | Group | Web Directory | File Access | Directory Access |
---|---|---|---|---|
Daily Planet Employees | wgdailyplanet | /opt/web/php/dailyplanet/ | Read, Write and Execute | Read, Write and Execute |
LexCorp Employees | wglexcorp | /opt/web/php/lexcorp/ | Read, Write and Execute | Read, Write and Execute |
Apache Server | www-data | /opt/web/php/dailyplanet/ /opt/web/php/lexcorp/ | Read | Read and Execute (required to transverse directories) |
Staff Users | staff | /opt/web/php/dailyplanet/ | Read | Read and Execute (required to transverse directories) |
Other | No Access | No Access |
We do not want employees from different companies access or even have awareness of each others web directory. At the same time, the Apache Server running as user www-data belonging to group www-data also needs access to the directories. We also want to grant users of the staff group read access for support purposes.
Creating the Directory Structure and Permissions
Directory | Permissions | ACL | ACL(default) |
---|---|---|---|
/web/ | rwXr-X--X | www-data:rX | www-data:rX |
/web/php/ | rwXr-X--X | www-data:rX | www-data:rX |
/web/php/tmp/ | rwXr-X--- | www-data:rwX | www-data:rwX |
/web/php/logs/ | rwXr-X--- | www-data:rwX | www-data:rwX |
/web/php/dailyplanet/ | rwXr-X--- | www-data:rX wgdailyplanet:rwX | www-data:rX wgdailyplanet:rwX |
/dailyplanet/www/ | rwXr-X--- | www-data:rX wgdailyplanet:rwX | www-data:rX wgdailyplanet:rwX |
/dailyplanet/blog/ | rwXr-X--- | www-data:rX wgdailyplanet:rwX | www-data:rX wgdailyplanet:rwX |
/dailyplanet/blog/wp-content/ | rwXr-X--- | www-data:rwX wgdailyplanet:rwX | www-data:rwX wgdailyplanet:rwX |
/web/php/lexcorp/ | rwXr-X--- | www-data:rX wglexcorp:rwX | www-data:rX wglexcorp:rwX |
/lexcorp/www/ | rwXr-X--- | www-data:rX wglexcorp:rwX | www-data:rX wglexcorp:rwX |
/lexcorp/blog/ | rwXr-X--- | www-data:rX wglexcorp:rwX | www-data:rX wglexcorp:rwX |
/lexcorp/blog/wp-content/ | rwXr-X--- | www-data:rwX wglexcorp:rwX | www-data:rwX wglexcorp:rwX |
All directories must be owned by serveradmin:staff
web Folder
Start by creating the web folder in your home directory so you do not have to keep sudo
sudo mkdir web #next set the permissions sudo chmod u+rwX,g+r-w+X,o-rw+X web sudo chown -R serveradmin:staff web #now set www-data for the acl sudo setfacl -Rm g:www-data:rX ./web/ sudo setfacl -Rm g:staff:rX ./web/
Now check your permissions for the web folder
getfacl web # file: web # owner: serveradmin # group: staff user::rwx group::r-x group:www-data:r-x group:staff:r-x mask::r-x other::--x
Now look at the defaults of the folder the default affects the folders and files created within this folder
getfacl --default web # file: web # owner: serveradmin # group: staff
To apply the permissions to defaults use
getfacl --access ./web/ | sudo setfacl -d -RM - ./web/
getfacl --access = retrieves the ACL the permissions applied to the directory only (default permissions are not returned). The details are then piped to setfacl and the parameters read,
-d = Change default permissions for newly created files and folder.
-M = Take as input files. Because the dash is used, the file is instead standard input.
R = Apply changes recursively to folders and files.
The default ACLs should now be changed,
getfacl --default ./web/ # file: web # owner: serveradmin # group: staff user::rwx group::r-x group:www-data:r-x group:staff:r-x mask::rwx other::---
If you want to see what the applied and default look like dont specify
getfacl ./web/ # file: web # owner: serveradmin # group: staff user::rwx group::r-x group:www-data:r-x group:staff:r-x mask::rwx other::--- default:user::rwx default:group::r-x default:group:www-data:r-x default:group:staff:r-x default:mask::rwx default:other::---
php Folder
Now go into the web folder and create the php folder
cd web sudo mkdir php sudo chown -R serveradmin:staff php getfacl php # file: php # owner: serveradmin # group: staff user::rwx group::r-x group:www-data:r-x group:staff:r-x mask::r-x other::--x default:user::rwx default:group::r-x default:group:www-data:r-x default:group:staff:r-x default:mask::r-x default:other::--x
The php folder has inherited the permissions from web. If you notice the next set of folders do not use execute for others so rather than setting others permission for each folder simply change the php others permission.
sudo chmod o-rwx php #next apply this change to default getfacl --access ./php/ | sudo setfacl -d -RM - ./php/ #check the permissions getfacl php # file: php # owner: serveradmin # group: staff user::rwx group::r-x group:www-data:r-x group:staff:r-x mask::r-x other::--- default:user::rwx default:group::r-x default:group:www-data:r-x default:group:staff:r-x default:mask::r-x default:other::---
Setting up the Virtual Hosts Structure
Next create your folders
cd php sudo mkdir dailyplanet sudo mkdir lexcorp sudo mkdir tmp sudo mkdir logs #remember serveradmin:staff must own the directory cd .. sudo chown -R serveradmin:staff php #change the php folder permissions back to the way it was sudo chmod o-rw+X php getfacl --access ./php/ | sudo setfacl -d -RM - ./php/ #check the permissions getfacl php
Now to add the necessary groups to their respective virtual hosts
cd php sudo setfacl -Rm g:wgdailyplanet:rwX dailyplanet getfacl --access ./dailyplanet/ | sudo setfacl -d -RM - ./dailyplanet/ cd dailyplanet sudo mkdir www sudo mkdir blog cd .. sudo chown -R serveradmin:staff dailyplanet
Repeat the same steps for lexcorp and change the group accordingly,
Testing Restrictions
User Lex Luthor has been given access to his directory "lexcorp" but learns of the "dailyplanet" directory by using his robots to spy on Clark Kent's computer. So Lex terminals in...
cd /opt/web/php/ cd dailyplanet -su: cd: dailyplanet: Permission denied
Backup and Restore
Introduction
The current (September 2012) GNU version of TAR does not support ACLs without modifications.
As with any backup and restore scenario where user based permissions matter, make sure the users actually exist and match. To ensure you have no issues, also ensure consistent use of user and group UIDs.
Backup
ACLs permissions can be backed up to a text file,
sudo getfacl -R dailyplanet/ > ~/dailyplanet.acl.bck.txt
It is important to run getfacl with sudo so that getfacl can properly transverse the directories and owner comments or group comments will be retained.
Backup the files into tar and gzip or similar program,
# consider command what will also drop in the acl.bck file.
Restore
Uncompress the backup, in this case we used the tar with gunzip,
....
Restoring ACLs
Restoring is a pretty straightforward process.
cd /opt/web/php/ sudo setfacl --restore ./bck.dailyplanet.acl.bck.txt
References
Good introduction from the Ubuntu docs - https://help.ubuntu/community/FilePermissionsACLs
Slightly Skeptical view on ACLs - http://softpanorama.org/Articles/slightly_skeptical_view_on_unix_acl.shtml
Got me to understand why execute permission was set on the groups - http://superuser/questions/180545/setting-differing-acls-on-directories-and-files
Notes on backup and restoring ACLs using dump file - http://projectenvision/blog/4/Enable-Support-for-ACL-in-Debian-Ubuntu
Good article on masks - http://novell/documentation/suse91/suselinux-adminguide/html/apbs03.html