VPS Access Contol Lists support

[twright]

Hi,
for my Linux VPS in need to enable Access Control Lists as a way to give some users Read/Write access to certain files whilst keeping the general permissions tight. To enable access control lists one generally needs to specify the acl option in /etc/fstab but on the VPS the root file system is not mounted through /etc/fstab.

If anyone knows how to sets mount options on VPSs or how to get ACL working their help would be greatly appreciated.

Thanks,
Tom Wright

[Rock]

Hi Tom,

ACL or Access Control List is enabled on your VPS, it's inbuilt with the latest Virtuozzo kernel, hence no need to mount or change anything in the /etc/fstab.

Here are few tests which you can demonstrate the working of ACLs on your VPS.. :)

Check the installed RPMs:

[sup@noc ~]# rpm -qa | grep acl
acl-2.2.39-3.el5
libacl-2.2.39-3.el5
libacl-devel-2.2.39-3.el5

The syntax of setting up the ACLs:

[sup@noc ~]# setfacl -m g:GROUPNAME:r FILENAME
[sup@noc ~]# setfacl -m u:USERNAME:r FILENAME

Options used:

-m = modify
-x = remove

u: = user
g: = group

:r = read
:w = write
:x = execute

Setting up the ACLs:

[sup@noc ~]# chown tom.tom test.tar.gz
[sup@noc ~]# setfacl -m g:tom:r test.tar.gz

Checking the ACLs using getfacl command:

[sup@noc ~]# getfacl test.tar.gz
 # file: test.tar.gz
 # owner: tom
 # group: tom
 user::rw-
 group::r--
 group:tom:r--
 mask::r--
 other::r--

Few more examples:

Granting an additional user read access:

           setfacl -m u:lisa:r file

Revoking write access from all groups and all named users (using the effective rights mask):

           setfacl -m m::rx file

Removing a named group entry from a file's ACL:

           setfacl -x g:staff file

Copying the ACL of one file to another:

           getfacl file1 | setfacl --set-file=- file2

Copying the access ACL into the Default ACL:

           getfacl --access dir | setfacl -d -M- dir

Please do let us know if you need any further assistance with this.. Wishing you a nice weekend :)

[twright]

Thanks for your help,
it seems to be working fine now (I think the problem before is that I was not testing it right (apparently cd does not work without +x ) )

It is great that you are one of the few hosts with ACL set up by default and it has really saved me a lot of time

Sadly it looks like ACL rules are not applied in SFTP so I guess I will need to look at NFS again.

[Rock]

You're welcome.. Tom Good luck with it..