|
List Info Thread: commands
[1-6]
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
about | contact Other archives ( Real Estate discussion Medical topics ) |
||||||||||||||||||||||||||||||||||||||||||||||||||||
commands |
|
List Info Thread: commands
[1-6]
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
about | contact Other archives ( Real Estate discussion Medical topics ) |
||||||||||||||||||||||||||||||||||||||||||||||||||||
unixdevweb1-vm sites]$ ls -al | grep www-su
drwxrws---+ 5 www-su www-su 4096 Nov 15 2006 www-su
That says, let the user www-su and members of the group
www-su
read/write to that directory. It also says preserve group
membership on
files contained in that directory as www-su.
Now lets look at the facl:
# file: www-su
# owner: www-su
# group: www-su
user::rwx
group::rwx
group:apache:r-x
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:www-su:rwx
default:mask::rwx
default:other::---
Which says additionally allows members of the apache group
to read the
files and also gives default permissions for objects created
in the
directory. ACLs are much much more powerful than files.
Lets take the case of the user owning that file which is
owned by
www-su:www-su. If the user wants to let additional people
read/write the
file they can only do so by editing /etc/group - which isn't
something
normal users can do... or with ACLs they can do
"setfacl -m
u:someuser:rwx www-su" and grant the permissions
themselves.
I think it would be fair to say that ACLs are less popular
than
traditional permissions, but they are not equivalent.
> Another question is why the chattr command even exists,
since only 3
> of its options even work with newer filesystems now,
what use is
> setting the (i) attribute compared to chmod 400?
If I chmod 400 the file, root can still delete it. If I
chattr +i the
file, even root can't delete it without removing the
immutable bit
first. It provides an additional safety level.
--
Sam
_______________________________________________
rhelv5-list mailing list
rhelv5-list
There is
only
one user associated with a file - the file's owner. There's
only one
group associated with a file, commonly users.
If I read the ACL documentation aright, and my understanding
from it is
consistent other environments, I can create an ACL that says
"user
solarflow99 can read this file."
selinux has me confounded, I don't know whether I want to
spend the
trouble to comprehend it.
> Another question is why the chattr command even exists,
since only 3 of its
> options even work with newer filesystems now, what use
is setting the (i)
> attribute compared to chmod 400?
+i prevents root. I've used it sometimes to protect
/etc/resolv.conf
I regularly use +a on .bash_history to avoid lost history.
Search
debian's security guide.
+S might be useful for xen filessystems in files, but I'd
want to test
performance before using it.
I thought the man page says three do not work?
--
Cheers
John
-- spambait
1aaaaaaa