Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Installation Manual

Page: 302 / 982

default ACL
Default ACLs can only be applied to directories. They determine the permissions
a file system object inherits from its parent directory when it is created.
ACL entry
Each ACL consists of a set of ACL entries. An ACL entry contains a type, a qual-
ifier for the user or group to which the entry refers, and a set of permissions. For
some entry types, the qualifier for the group or users is undefined.
14.4 Handling ACLs
Table 14.1, “ACL Entry Types” (page 285) summarizes the six possible types of ACL
entries, each defining permissions for a user or a group of users. The owner entry defines
the permissions of the user owning the file or directory. The owning group entry defines
the permissions of the file's owning group. The superuser can change the owner or
owning group with
chown
or
chgrp
, in which case the owner and owning group entries
refer to the new owner and owning group. Each named user entry defines the permissions
of the user specified in the entry's qualifier field. Each named group entry defines the
permissions of the group specified in the entry's qualifier field. Only the named user
and named group entries have a qualifier field that is not empty. The other entry defines
the permissions of all other users.
The mask entry further limits the permissions granted by named user, named group,
and owning group entries by defining which of the permissions in those entries are ef-
fective and which are masked. If permissions exist in one of the mentioned entries as
well as in the mask, they are effective. Permissions contained only in the mask or only
in the actual entry are not effective—meaning the permissions are not granted. All
permissions defined in the owner and owning group entries are always effective. The
example in
Table 14.2, “Masking Access Permissions” (page 285) demonstrates this
mechanism.
There are two basic classes of ACLs: A minimum ACL contains only the entries for
the types owner, owning group, and other, which correspond to the conventional per-
mission bits for files and directories. An extended ACL goes beyond this. It must contain
a mask entry and may contain several entries of the named user and named group types.
284 Installation and Administration