Before creating the directory, use the
umask
command to define which access permis-
sions should be masked each time a file object is created. The command
umask 027
sets the default permissions by giving the owner the full range of permissions (
0
),
denying the group write access (
2
), and giving other users no permissions at all (
7
).
umask
actually masks the corresponding permission bits or turns them off. For details,
consult the
umask
man page.
mkdir mydir
creates the
mydir
directory with the default permissions as set by
umask
. Use
ls -dl mydir
to check whether all permissions were assigned correctly.
The output for this example is:
drwxr-x--- ... tux project3 ... mydir
With
getfacl mydir
, check the initial state of the ACL. This gives information
like:
# file: mydir
# owner: tux
# group: project3
user::rwx
group::r-x
other::---
The first three output lines display the name, owner, and owning group of the directory.
The next three lines contain the three ACL entries owner, owning group, and other. In
fact, in the case of this minimum ACL, the
getfacl
command does not produce any
information you could not have obtained with
ls
.
Modify the ACL to assign read, write, and execute permissions to an additional user
geeko
and an additional group
mascots
with:
setfacl -m user:geeko:rwx,group:mascots:rwx mydir
The option
-m
prompts
setfacl
to modify the existing ACL. The following argument
indicates the ACL entries to modify (multiple entries are separated by commas). The
final part specifies the name of the directory to which these modifications should be
applied. Use the
getfacl
command to take a look at the resulting ACL.
Access Control Lists in Linux
137
Содержание LINUX ENTERPRISE DESKTOP 11
Страница 1: ...SUSE Linux Enterprise Server www novell com 11 March 17 2009 Security Guide...
Страница 9: ...32 7 Managing Audit Event Records Using Keys 433 33 Useful Resources 435...
Страница 10: ......
Страница 29: ...Part I Authentication...
Страница 30: ......
Страница 55: ...Figure 4 2 YaST LDAP Server Configuration LDAP A Directory Service 41...
Страница 126: ......
Страница 127: ...Part II Local Security...
Страница 128: ......
Страница 158: ......
Страница 173: ...Part III Network Security...
Страница 174: ......
Страница 194: ......
Страница 197: ...Figure 16 2 Scenario 2 Figure 16 3 Scenario 3 Configuring VPN Server 183...
Страница 210: ......
Страница 228: ......
Страница 229: ...Part IV Confining Privileges with Novell AppArmor...
Страница 230: ......
Страница 274: ......
Страница 300: ......
Страница 328: ......
Страница 340: ......
Страница 342: ......
Страница 386: ......
Страница 387: ...Part V The Linux Audit Framework...
Страница 388: ......