An access control list (ACL) provides a more granular approach to permissions, allowing the system administrator the ability to move past the limitations of Linux permissions when the situation warrants it.
For instance, perhaps you have a complex use case that requires granting permissions to multiple individual users, or maybe to more then a single group. Some people would get around this by simply using 777 permissions, but that in and of itself is a very poor security practice.
ACLs can help solve this as they allow you to create a sophisticated permissions scheme that grant access to the users and groups that require it, without the need to open the permissions broadly for everyone.
With all this being said, ACLs should only be used when standard permissions cannot accomplish what your looking to do. ACLs are often used as the ‘quick fix’, but while they do work, they can overly complicate an environment that could cause major headaches while troubleshooting. There is also more room for error, as you are adding an additional layer of complication when employing ACLs.
Enabling ACLs on the filesystem
Setting up a system for ACLs are pretty simple. If you are running a system that uses systemd, then ACLs should already been enabled as its a dependency for systemd. For older systems, the process is shown below for installing and enabling ACLs.
First, check to see if ACLs are already enabled on the filesystem:
[root@web01 ~]# tune2fs -l /dev/sda1 |grep acl Default mount options: user_xattr acl
If you do not see ‘acl’ in the output, then you can install ACLs by:
# CentOS / RHEL: [root@web01 ~]# yum install acl # Ubuntu / Debian: [root@web01 ~]# apt-get update [root@web01 ~]# apt-get install acl
Now for all distros, enable ACLs in your /etc/fstab putting ‘acl’ in the mount opens as shown below:
[root@web01 ~]# cat /etc/fstab /dev/mapper/VolGroup-lv_root / ext4 defaults,acl 1 1
Then remount the filesystem so the new mount option takes effect by:
[root@web01 ~]# mount -o remount /
Then verify that ACL’s are now enabled on the filesystem:
[root@web01 ~]# tune2fs -l /dev/sda1 |grep acl Default mount options: user_xattr acl
Using ACLs
You can determine if a file or directory has an ACL in place as the permissions will be followed by a ‘+’ as shown below:
[root@web01 ~]# ls -al ... -rw-rwxr--+ 1 root root 93 Jan 12 11:22 test ...
You can see what ACLs have been assigned to the file by:
[root@web01 ~]# getfacl test # file: test # owner: root # group: root user::rw- user:jdoe:rwx group::r-- mask::rwx other::r--
So in the example above, we see a user called jdoe also rwx permissions to the file called test.
To add or modify a user ACL:
[root@web01 ~]# setfacl -m u:jdoe:permissions /var/www/vhosts/domain.com
To add or modify a group ACL:
[root@web01 ~]# setfacl -m g:devs:permissions /var/www/vhosts/domain.com
To modify the ‘other’ ACL:
[root@web01 ~]# setfacl -m o:permissions /var/www/vhosts/domain.com
To add or modify an ACL recursively, you use the -R option. It is important to note that it is considered good practice to use the -X (capital X) permission when using recursion so files can retain the execute permission if they have them, but also allow you to traverse the directory as that requires the execute permission. The benefit comes into play with the -X (capital X) as it will prevent an admin from accidentally adding the execute permission on a regular file. An example of this is below:
[root@web01 ~]# setfacl -R -m u:jdoe:rwX /var/www/vhosts/domain.com
To set the default ACL so all new directories will inherit the ACL’s set on the parent directory:
[root@web01 ~]# setfacl -R -m default:u:jdoe:rwX /var/www/vhosts/domain.com
To remove a user from an ACL:
[root@web01 ~]# setfacl -x u:jdoe /var/www/vhosts/domain.com
To remove a group from an ACL:
[root@web01 ~]# setfacl -x g:devs /var/www/vhosts/domain.com
Remove ALL ACL’s on a file/directory:
[root@web01 ~]# setfacl -b /var/www/vhosts/domain.com
Remove ALL ACL’s on a file/directory recursively:
[root@web01 ~]# setfacl -R -b /var/www/vhosts/domain.com