group still getting "Permission denied" after ACL added to directory with setfacl
I had problem using setfacl for group to access directory /subdirectory of other user at RHEL 7.2 (and 6.7 as well) . Followings are my screen shots after each change
first I used "setfacl -b myApp/" to remove all previous settings and start over
[user1@localhost ~]$ tail -10 /etc/group
....
user1:x:1002:user1
user2:x:1003:user2
user3:x:1004:user3
ncuser:x:1005:user3,user2
[user1@localhost ~]$ setfacl -Rm g:ncuser:wrX myApp/
[user1@localhost ~]$ getfacl myApp/
file: myApp/
owner: user1
group: user1
user::rwx
group::rwx
group:ncuser:rwx
mask::rwx
other::r-x
switch to user2
[user2@localhost ~]$ touch /neet/user1/myApp/a
touch: cannot touch ‘/neet/user1/myApp/a’: Permission denied
switch back user1
[user1@localhost ~]$ setfacl -Rm d:g:ncuser:wrX myApp/
[user1@localhost ~]$ getfacl myApp/
file: myApp/
owner: user1
group: user1
user::rwx
group::rwx
group:ncuser:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:ncuser:rwx
default:mask::rwx
default:other::r-x
switch to user2
[user2@localhost ~]$ touch /neet/user1/myApp/a
touch: cannot touch ‘/neet/user1/myApp/a’: Permission denied
[user2@localhost ~]$ cd /neet/user1/myApp/data
bash: cd: /neet/user1/myApp/data: Permission denied
switch to user1
[user1@localhost ~]$ find myApp -perm /111 -exec setfacl -m g:ncuser:rwX {} \;
[user1@localhost ~]$ find myApp -not -perm /111 -exec setfacl -m g:ncuser:rw {} \;
[user1@localhost ~]$ getfacl myApp/
file: myApp/
owner: user1
group: user1
user::rwx
group::rwx
group:ncuser:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:ncuser:rwx
default:mask::rwx
default:other::r-x
switch to user2
[user2@localhost ~]$ touch /neet/user1/myApp/a
touch: cannot touch ‘/neet/user1/myApp/a’: Permission denied
Above were tested in my virtual RHEL 7.2 and I repeated the same scripts on physical RHEL 6.7, and turn out the same result. I checked with many sites online, they all referred to the same setfacl script. However, if I setfacl the same myApp with user2 (or user3) u:user2:rwX myApp/, the rule worked, meaning user2 could touch, cp or edit a file under myApp/
Responses
Can you as the user2 access each of the directories above MyApp as that may be where they are denied?
Guru
6435 points
I'm really having a hard time parsing the text you copied from your terminal session. Unless you put what you paste into a code-style block, this site's Markdown interpreter will munge its presentation. See the Formatting Help link (or Google around for MarkDown Syntax` - Daring Fireball's will probably be one of your first hits - it's pretty easy to follow).
That said, if you only set an ACL on the directory, any files with existing permissions/ACLs will not get updated by default. You would have to set both a default ACL on the directory and recursively update the ACLs on files/directories hosted under the directory you set the ACL on. If you only do the former, it will only effect permissions/ACLs on files/directories created after the setfacl operation. Doing the latter ensures that files/directories that existed prior to the setfacl operation also get updated.
Guru
6435 points
No worries on the formatting - it's just one of the vargaries of a MarkDown enabled posting-system (and this one's interpretation of MarkDown seems a touch "off" at any rate).
At any rate, what I'm saying is that if you have:
- /dir1
- /dir1/fileA
- /dir1/dir2
The default ACL only effects newly-created files. Thus, if after your setfacl you created /dir2/fileB or /dir1/dir3, those new objects should have the default permissions applied. Whereas, if your setfacl operation is only done against /dir1, but you did not take care to also apply it to /dir1/fileA and/or /dir1/dir2, you would not have changed the permissions on those objects.
You can try this to set the ACLs for the group. It will allow full access to files in the directory location. This will also set a file mask for any file created after. That will be affected by the umask as well.
setfacl -Rm d:g:ncuser:rwx /neet/user1/myAppS
To remove write access to regular files that are exicuable in the location run the coammds below.
find /neet/user1/myAppS -perm /111 -exec setfacl -m g:ncuser:rw {} \;
find /neet/user1/myAppS -not -perm /111 -exec setfacl -m g:ncuser:rw {} \;
Sorry one correction the command to not allow the ACL group to write to regular files is. The command in the previous post would allow them to write but not execute.
find /neet/user1/myAppS -perm /111 -exec setfacl -m g:ncuser:rx {} \;
I would start with removeing all the ACLs that are there now as they do not seem to be right.
setfacl -b -R /neet/user1/myApp
Add ACLs to allow access to the directory structure.
setfacl -Rm d:g:user2:rwx /neet
If you do not was the user to be able to create or edit files in the upper directories remove write access find /neet -not -perm /111 -exec setfacl -m g:user2:r {} \; find /neet -perm /111 -exec setfacl -m g:user2:rx {} \;
At this point you user should have read-only access to the directories under /neet
If you removed the write access from the upper dorectories and want to allow it in myApp you can add them back with the commands.
setfacl -Rm d:g:user2:rwx /neet/user1/myApp
To grant full access to everything under myApp for the ACL group
find /neet/user1/myApp -perm /111 -exec setfacl -m g:user2:rwx {} \;
If you want to remove write access to regular files in this location that are currently executalble. This will not remove access from any directory under myApp.
find /neet/user1/myApp -type f -perm /111 -exec setfacl -m g:user2:rx {} \;
The previous command will not remove access from any directory under myApp.
If you want a group to be able to write to a directory the group acl on the directory must have write in it. The example you posted shows it does not. the line below "group:ncuser:r-x" show that the group ncuser only has read and execute.
[user1@localhost ~]$ getfacl /neet/user1/myApp/ getfacl: Removing leading '/' from absolute path names
file: neet/user1/myApp owner: user1 group: user1user::rwx group::rwx group:ncuser:r-x mask::rwx other::r-x
To make it so the group has write in that directory .
sudo setfacl -m d:g:ncuser:rwx /neet/user1/myApp/
If you want them to be able to write to subdirectories in the location add the -R option for recursive
sudo setfacl -Rm d:g:ncuser:rwx /neet/user1/myApp/
To make it so the group can modify files in that directory and it's subdirectory use the finf commands and add the write option where you want it
To make it so the group has write access to files without an execute bit set use this command.
find /neet/user1/myApp -type f -not -perm /111 -exec setfacl -m g:ncuser:rw {} \;
If you want them to be able to change files (such as scripts) with and execute bit set issue this command.find /neet/user1/myApp -type f -perm /111 -exec setfacl -m g:ncuser:rwx {}
If you want these permissions high in the directory tree just change the path. I you do not want it extend the write permission to directories below limit the find command with the -maxdepth option.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.