Chris Tyler - Fedora Linux

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

/dev/hdc2 on /boot type ext3 (rw)

tmpfs on /dev/shm type tmpfs (rw)

/dev/mapper/main-home on /home type ext3 (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

automount(pid10695) on /net type autofs (rw,fd=4,pgrp=10695,minproto=2,maxproto=4)

If you kept the default volume group and logical volume names during installation, you may see device paths such as /dev/mapper/VolGroup00-LogVol01 .

The mount options are shown in parentheses; none of these filesystems were mounted with the acl option.

To add the acl mount option to a filesystem that is already mounted, use the mount command with the remount option:

# mount -o remount,acl /home

# mount -o remount,acl /

# mount

/dev/mapper/main-root on / type ext3 (rw,acl)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

/dev/hdc2 on /boot type ext3 (rw)

tmpfs on /dev/shm type tmpfs (rw)

/dev/mapper/main-home on /home type ext3 (rw,acl)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

automount(pid10695) on /net type autofs (rw,fd=4,pgrp=10695,minproto=2,maxproto=4)

Note that the /home and / filesystems are now mounted with the acl option. To make this option the default for future mounts of these filesystems, edit the file /etc/fstab and add it to the fourth column for these filesystems:

/dev/main/root / ext3 defaults ,acl1 1

LABEL=/boot /boot ext3 defaults 1 2

devpts /dev/pts devpts gid=5,mode=620 0 0

tmpfs /dev/shm tmpfs defaults 0 0

proc /proc proc defaults 0 0

sysfs /sys sysfs defaults 0 0

/dev/main/swap swap swap defaults 0 0

/dev/main/home /home ext3 defaults ,acl1 2

Once the filesystem has been mounted with the correct option, the getfacl (get file ACL) command can be used to view the ACL of a file:

$ touch test

$ ls -l test

-rw-rw-r-- 1 chris chris 0 May 6 20:52 test

$ getfacl test

# file: test

# owner: chris

# group: chris

user::rw-

group::rw-

other::r--

The ACL displayed by getfacl exactly matches the permissions shown by ls : the user who owns the file ( chris ) can read and write the file, users in the group that owns the file ( chris ) can read and write the file, and all of the other users of the system can only read the file.

Each entry in the ACL consists of three components separated by colons:

type

The keyword user , group , mask , or other . This may be abbreviated to u , g , m , or o when setting or changing ACL entries.

qualifier

The name of the user or group affected by this entry. User type entries with an empty qualifier apply to the user that owns the file; group type entries with an empty qualifier apply to the group that owns the file. mask and other enTRies always have an empty qualifier.

permissions

The permissions granted by the entry; any combination of r (read), w (write), and x (execute). When displayed by the getfacl command, the permissions are always shown in rwx order, and permissions that are not granted are replaced with a dash.

To modify the ACL, use the setfacl command with the -m (modify) option. This command will limit the user thomas to just reading the file test :

$ setfacl -m user:thomas:r test

$ getfacl test

# file: test

# owner: chris

# group: chris

user::rw-

user:thomas:r--

group::rw-

mask::rw-

other::r--

This additional ACL entry shows up on a line of its own. Notice that a mask entry is now displayed, showing the maximum permission available to users and groups identified by a qualifier; this mask value corresponds to the group permission of the traditional Linux permission mode, as displayed by ls .

When ls is used to display detailed file information, the output is slightly modified:

$ ls -l test

-rw-rw-r--+ 1 chris chris 0 May 6 20:52 test

The + after the file permissions indicates that an ACL is in effect in addition to the permissions shown.

Changing the file mode using the chmod command alters the ACL mask value:

$ chmod 644 test

$ ls -l test

-rw-r--r--+ 1 chris chris 0 May 6 20:52 test

$ getfacl test

# file: test

# owner: chris

# group: chris

user::rw-

user:thomas:r--

group::rw- #effective:r--

mask::r--

other::r--

The new group permission has been set to r-- (read-only), and this is also used as the mask value. Because the mask is more limiting than the group value in the ACL, the group permission has effectively changed to r-- , as indicated by the #effective:r-- comment in the output.

This works both ways; changing the mask using setfacl also changes the group permission, as displayed by ls :

$ ls -l test

-rw-r--rwx+ 1 chris chris 0 May 6 20:52 test

$ setfacl -m mask::rw test

$ ls -l test

-rw-rw-rwx+ 1 chris chris 0 May 6 20:52 test

$ getfacl test

# file: test

# owner: chris

# group: chris

user::rw-

user:thomas:r--

group::rw-

mask::rw-

other::rwx

On the other hand, changing the default group ACL entry affects both that entry and the mask value:

$ setfacl -m g::r test

$ ls -l test

-rw-r--r--+ 1 chris chris 0 May 6 20:52 test

$ getfacl test

# file: test

# owner: chris

# group: chris

user::rw-

user:thomas:r--

group::r--

mask::r--