CentOS Icon CentOS Logo
CentOS Text
   
  
www.centos.org Forum Index
   CentOS 6 - Security Support
  [SOLVED] ACLs work on my CentOS server without enabling on the file system

 

 Bottom   Previous Topic   Next Topic
  •  Rate Thread
      Rate this Thread
      Excellent
      Good
      Average
      Bad
      Terrible
Poster Thread
  •  m223464
      m223464
[SOLVED] ACLs work on my CentOS server without enabling on the file system
#1
Peeking in the Member Window
Joined: 2012/3/7
From
Posts: 13
Hi,

I'm trying to teach myself Linux using the RHCSA/RHCE Redhat Linux Certifiation Guide. I'm working through the section on ACLs and I'm not experiencing the behaviour described in the guide and would appreciate someone's guidance on this please.

The guide states "Before a file or directory can be configured with ACLs, you need to mount the associated filesystem with the same attribute."
e.g.
# mount -o remount -o acl /dev/sda3 /home

# mount|grep acl
/dev/sda3 on /home type ext4 (rw,acl)

Whilst exploring this feature I have been able to set acls on directories and files in filesystems that haven't been mounted with the acl option, for example:

[root@test ~]# pwd
/root

[root@test ~]# df -h .
Filesystem Size Used Avail Use% Mounted on
/dev/vda5 6.0G 1.8G 3.9G 32% /

[root@test ~]# getfacl /root
getfacl: Removing leading '/' from absolute path names
# file: root
# owner: root
# group: root
user::r-x
group::r-x
other::---

[root@test ~]# mount|grep acl

[root@test ~]# setfacl -m u:gareth:rwx /root

[root@test ~]# getfacl /root
getfacl: Removing leading '/' from absolute path names
# file: root
# owner: root
# group: root
user::r-x
user:gareth:rwx
group::r-x
mask::rwx
other::---

[root@test ~]# su - gareth

[gareth@test ~]$ ls -l /root
total 36
-rw-------. 1 root root 991 Mar 1 19:35 anaconda-ks.cfg
-rw-r--r--. 1 root root 107 Mar 1 19:38 ifcfg-eth0.dhcp
-rw-r--r--. 1 root root 203 Mar 1 20:46 ifcfg-eth0.static
-rw-r--r--. 1 root root 16375 Mar 1 19:34 install.log
-rw-r--r--. 1 root root 5658 Mar 1 19:31 install.log.syslog
[gareth@test ~]$ logout

[root@test ~]# setfacl -b /root

[root@test ~]# getfacl /root
getfacl: Removing leading '/' from absolute path names
# file: root
# owner: root
# group: root
user::r-x
group::r-x
other::---

Is anyone able to offer any guidance on this? I've trawled the internet and already searched this forus but can't get an answer.

Regards

Gareth
Posted on: 2012/3/7 16:39
Create PDF from Post Print
Top
  •  gerald_clark
      gerald_clark
Re: ACLs work on my CentOS server without enabling on the file system
#2
Professional Board Member
Joined: 2005/8/5
From Northern Illinois, USA
Posts: 6183
They are enabled by default.
Posted on: 2012/3/7 18:50
Create PDF from Post Print
Top
  •  m223464
      m223464
Re: ACLs work on my CentOS server without enabling on the file system
#3
Peeking in the Member Window
Joined: 2012/3/7
From
Posts: 13
That's not implied at all in my certification guide and if that was the case why does the redhat documentation suggest otherwise aswell?

If it was enabled by default it's unlikely they would list it an example of a setting you'd add to a filesystem.
Posted on: 2012/3/7 22:12
Create PDF from Post Print
Top
  •  markkuk
      markkuk
Re: ACLs work on my CentOS server without enabling on the file system
#4
Professional Board Member
Joined: 2007/9/7
From Finland
Posts: 644
Use command "tune2fs -l" to see the options set for a file system, including the default mount options. For example:
[root@Centos ~]# tune2fs -l /dev/mapper/vg_centos-lv_root                   
tune2fs 1.41.12 (17-May-2010)                                               
Filesystem volume name:   <none>                                            
Last mounted on:          /                                                 
Filesystem UUID:          d7bd7ff6-111f-4da2-9ca8-84efadcb0fd7              
Filesystem magic number:  0xEF53                                            
Filesystem revision #:    1 (dynamic)                                       
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize                                                                  
Filesystem flags:         signed_directory_hash                                 
Default mount options:    user_xattr acl
...

Documentation isn't always right.
Posted on: 2012/3/8 11:28
Create PDF from Post Print
Top
  •  m223464
      m223464
Re: ACLs work on my CentOS server without enabling on the file system
#5
Peeking in the Member Window
Joined: 2012/3/7
From
Posts: 13
Many thanks Mark. It seems all the filesystems in my KVM have acls enabled by default

# tune2fs -l /dev/vda5
tune2fs 1.41.12 (17-May-2010)
Filesystem volume name:   <none>
Last mounted on:          /
Filesystem UUID:          e980b2e3-9753-406e-9fb2-ce1ec068f455
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize
Filesystem flags:         signed_directory_hash 
Default mount options:    user_xattr acl
.
.


So despite it not being listed as enabled when I run mount, it is actually enabled.

I tried setting an acl on filesystem that didn't have acls enabled by default and I got this error:

# setfacl -m u:test:rwx /acltest
setfacl: /acltest: Operation not supported

It all makes sense now...sort of.

Gareth
Posted on: 2012/3/8 14:31
Create PDF from Post Print
Top
  •  m223464
      m223464
Re: [SOLVED] ACLs work on my CentOS server without enabling on the file system
#6
Peeking in the Member Window
Joined: 2012/3/7
From
Posts: 13
Marking thread as solved (hopefully) by updating the subject.

Ah, seems not. Not sure how to mark this as solved.
Posted on: 2012/3/8 14:44
Create PDF from Post Print
Top
  •  AlanBartlett
      AlanBartlett
Re: [SOLVED] ACLs work on my CentOS server without enabling on the file system
#7
Moderator
Joined: 2007/10/22
From ~/Earth/UK/England/Suffolk
Posts: 9138
Just do as you have done.

Mark your last post to the thread appropriately and a moderator will do likewise, on your behalf, to the first post of the thread.
_________________
Alan

100% Unix & Linux. Co-founder of the ELRepo Project.
Posted on: 2012/3/8 19:21
Create PDF from Post Print
Top
 Top   Previous Topic   Next Topic

 

 You cannot start a new topic.
 You can view topic.
 You cannot reply to posts.
 You cannot edit your posts.
 You cannot delete your posts.
 You cannot add new polls.
 You cannot vote in polls.
 You cannot attach files to posts.
 You cannot post without approval.




"Linux" is a registered trademark of Linus Torvalds. | All other trademarks are property of their respective owners. | All other content is Copyright @ 2004-2009 by the CentOS Project or "each individual contributor (forums, comments, etc.) unless otherwise assigned".| Theme based on a theme by 7dana.com