Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 145 / 450

10
Access Control Lists in Linux
POSIX ACLs (access control lists) can be used as an expansion of the traditional per-
mission concept for file system objects. With ACLs, permissions can be defined more
flexibly than the traditional permission concept allows.
The term POSIX ACL suggests that this is a true POSIX (portable operating system
interface) standard. The respective draft standards POSIX 1003.1e and POSIX 1003.2c
have been withdrawn for several reasons. Nevertheless, ACLs as found on many systems
belonging to the UNIX family are based on these drafts and the implementation of file
system ACLs as described in this chapter follows these two standards as well. They
can be viewed at
http://wt.xpilot.org/publications/posix.1e/
.
10.1 Traditional File Permissions
Find detailed information about the traditional file permissions in the GNU Coreutils
Info page, Node File permissions (
info coreutils "File permissions"
).
More advanced features are the setuid, setgid, and sticky bit.
10.1.1 The setuid Bit
In certain situations, the access permissions may be too restrictive. Therefore, Linux
has additional settings that enable the temporary change of the current user and group
identity for a specific action. For example, the
passwd
program normally requires
root permissions to access
/etc/passwd
. This file contains some important informa-
tion, like the home directories of users and user and group IDs. Thus, a normal user
Access Control Lists in Linux 131