In this video you will learn about access control lists.
Access control lists are something that allows administrators to grant permissions to more
than one user and or more than one group.
It's really an extension to the basic permissions read, write and execute as you've learned
about earlier.
They are supported by all modern file systems as a default.
To work with access control lists, you can use the getfacl command to find out if any
current access control lists apply and setfacl to manage access control lists.
Now what are the use cases?
Access control lists may be used in different situations.
For example, in a shared user environment where one user or group needs full access
to files and other users or groups need read-only access.
That is a situation that you cannot do with basic permissions because basic permissions
as you remember, you have one group owner only.
Also you can use them in a developer environment where the developer may require access to
a server document root where you still want to make sure that the server document root
is owned by the appropriate process.
Let's check out how to manage them.
To see current ACLs, you use getfacl and to manage them, you use setfacl.
There is a regular ACL which will take care of all currently existing files and the default
ACL will take care of all new files.
And you should use ACLs as an infrastructure solution.
They should be configured on directories before you start to work with files in these directories.
Let me show you how you can use them.
So in order to do this demo, I need a group, let me create it, name of the group is account
and I need a directory structure.
So let me use mkdir-p to create the entire path for slash data slash sales.
Then first I'm going to use setfacl-r, uppercase R makes it recursive and minus M is for modify
followed by G colon account colon R uppercase X on data sales.
So this will modify the access control listing for data sales to add the group account as
a group owner.
And we have lowercase R uppercase X, uppercase X makes sure that the recursive ACL is not
going to make files but only directories executable.
And that is exactly what we want.
Now this is taking care of existing files, if any.
You also want to take care of anything that will be created from that moment on.
And that is the default ACL.
So again, setfacl-m for modify followed by D colon G colon account colon RX.
Default ACLs apply to directories only, so you don't need an uppercase X here.
And in order to make it a default ACL, you just put a D in front of the string.
And then data sales, which is a directory structure to which you want to set it.
Now we can check when I use getfacl on slash data slash sales, we can see the ACL setting.
So let's start on the bottom where we see the default ACL setting set to the user and
the group, which are the ordinary user and group owners.
And the group account, which has been added with the read and execute permission.
And as a result of this default ACL, what is going to happen if in data sales I create
a file?
Well, let's use getfacl on file one.
And there we can see that the group account also has a read permission on the file.
That's the purpose of the default ACL.
You want these permissions to be granted to all files and directories that are created
at this level.
Now you can also setfacl minus XG colon account.
And what is that going to do?
Well, unfortunately, for members of the group account, that is going to remove the ACL setting.
So getfacl on data sales is showing that the ACL has been removed, but not the default
ACL.
And can you imagine what to do to remove the default ACL as well?
Well, that should be D colon G colon account.
And that is how you can work with access control lists.