topic Re: Finding ACLs in Operating System - Linux

Finding ACLs

IT_2007 — Thu, 05 Oct 2006 08:58:13 GMT

Need to writeup a shell script to find the files which are having ACLs and then get details of each file using getacl command. Trying to tell users that setting up share group is much well controlled than setting ACLs for maintanence.

Any comments, suggestions??

Points will be awarded based on the solution and comments.

Thanks.

Re: Finding ACLs

Peter Godron — Thu, 05 Oct 2006 09:08:17 GMT

Hi,
see man lsacl:
" List ACLs for all files under mydir:

find mydir -print | sort | xargs lsacl
"

Re: Finding ACLs

IT_2007 — Thu, 05 Oct 2006 09:27:34 GMT

I don't know where and which files has been set for ACLs. when I ran above command, I am getting lot like:

lsacl: file "./oracleinstallfiles/9iclient/Disk3/stage/Components/oracle.options.intermedia.imserver/9.2.0.1.0/1": Operation not supported (errno = 223)

so my intention is to find out only the files which are set with ACLs starting from / level.

Re: Finding ACLs

Peter Godron — Thu, 05 Oct 2006 09:41:30 GMT

Hi,
depends on what filesystem setup you have.
Should work on hfs, but fails on vxfs.

Alternative is to either you find -acl (same problem), or use ll as thre will be a '+' at the end of the permissions section for each acl file.

Re: Finding ACLs

IT_2007 — Thu, 05 Oct 2006 09:46:06 GMT

As per man page of getacl, it works only for JFS not HFS.

getacl - list access control lists (ACLs) for files (JFS File Systems
only)

I have JFS filesystems and don't want to do on /stand which is HFS.

Re: Finding ACLs

Peter Nikitka — Thu, 05 Oct 2006 12:44:42 GMT

Hi,

if you want to ignore files without ACLs sort them out before feeding them to getacl (which will work well for JFS filesystems) or leave the getacl-call:

find mydir -print | xargs ls -god |
awk '$1 ~ ".*+$" {print $NF}' | xargs getacl

You will get problems with xargs with filenames containing spaces (as usual).

mfG Peter

Re: Finding ACLs

IT_2007 — Thu, 05 Oct 2006 13:06:54 GMT

Peter,

I ran your command and don't know what I am getting from it.

At present my current directory shows + sign for one directory only and doesn't have ACL for files inside it.

drwxrwsr-x+ 2 test test 4096 Sep 29 10:30 validate

Would you please explain?

Re: Finding ACLs

Peter Nikitka — Fri, 06 Oct 2006 05:59:12 GMT

Hi,

if you have a directory reported like this

drwxrwsr-x+ 2 test test 4096 Sep 29 10:30 validate

you have ACLs on it, which should be reported by
getacl validate

Ir does NOT mean, that file in this directory have ACLs as well: The mode of the directory may have been changed after the creation if files in it, and so the 'inheritance ACLs' (if an should be present) just did not exist at creation time.

mfG Peter

Re: Finding ACLs

IT_2007 — Fri, 06 Oct 2006 07:59:13 GMT

I am confused now. It shows the following:

# getacl validate
# file: validate
# owner: test
# group: test
user::rwx
user:sastest:rwx
group::rwx
class:rwx
other:r-x

So what would be the difference between normal file and ACL file ? You mean to say at the creation time ACL might have been set but it changed later?

Re: Finding ACLs

Peter Godron — Fri, 06 Oct 2006 08:09:12 GMT

Hi,
your user sastest will have rwx priv on validate
So can limit to individual users, if you so wish, rather than groups.