Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 151 / 450

Before creating the directory, use the
umask
command to define which access permis-
sions should be masked each time a file object is created. The command
umask 027
sets the default permissions by giving the owner the full range of permissions (
0
),
denying the group write access (
2
), and giving other users no permissions at all (
7
).
umask
actually masks the corresponding permission bits or turns them off. For details,
consult the
umask
man page.
mkdir mydir
creates the
mydir
directory with the default permissions as set by
umask
. Use
ls -dl mydir
to check whether all permissions were assigned correctly.
The output for this example is:
drwxr-x--- ... tux project3 ... mydir
With
getfacl mydir
, check the initial state of the ACL. This gives information
like:
# file: mydir
# owner: tux
# group: project3
user::rwx
group::r-x
other::---
The first three output lines display the name, owner, and owning group of the directory.
The next three lines contain the three ACL entries owner, owning group, and other. In
fact, in the case of this minimum ACL, the
getfacl
command does not produce any
information you could not have obtained with
ls
.
Modify the ACL to assign read, write, and execute permissions to an additional user
geeko
and an additional group
mascots
with:
setfacl -m user:geeko:rwx,group:mascots:rwx mydir
The option
-m
prompts
setfacl
to modify the existing ACL. The following argument
indicates the ACL entries to modify (multiple entries are separated by commas). The
final part specifies the name of the directory to which these modifications should be
applied. Use the
getfacl
command to take a look at the resulting ACL.
Access Control Lists in Linux 137