Simple ACL question - Lots of points!!!

[Helen French]

Can anyone give me a quick lesson on ACL's and how they work, I have people able to browse directories that should not be "world" readable. They have no file access but they can see my directory structure and file but can't open them.

I was told that a script is running that resets my ACL's every so often. I'm not sure it's running...

New to the UNIX world,

Andy

[Marcel Boon · Accepted solution]

Hi,

Look at :

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90701/B2355-90701_top.html&con=/hpux/onlinedocs/B2355-90701/00/00/62-con.html&toc=/hpux/onlinedocs/B2355-90701/00/00/62-toc.html&searchterms=acl&queryid=20010314-071829


Goodluck !

Marcel

[Bill McNAMARA_1]

The man pages you're interested in are
lsacl and chacl
however the use of acls is heavily dependant on your filesystem. You will need JFS version
3.3 to do them or else use HFS filesystems.

What the essentially do is to finetune access
control to files a little more in depth than
just users group and others.

The commandline syntax is a little bizarre, but
well documented in the man.

Later,
Bill

[Helen French]

Does anyone know what "world" means and how can I make sure no one who has no access can not see my directory structure.

No documentation is clear about that.

All the info is great so far.

Andy

[Marcel Boon]

Hi Andrew,


Let me explain the "Access Control List" (acl) a little bit more.
just an example:

(traditional)
ls -l tempfile
-rwxr-xr-x 1 steve sales 138 Jan 4 16:00 tempfile

With access control list:

lsacl -l tempfile
tempfile: # filename
rwx steve.% # read ,write an execute permission for user steve
r-x %.sales # read and execute permission for group sales
r-x %.% # read and execute permission all others (world)

You can see that "others" have read permission on tempfile.
If you want that "others" have no read permission you have to
change the rights on the file with:
chacl "%.% - r)" tempfile


Your question:

"world" is the same as "others"
So if you want that the "world" can not see your directory structure,
you have to change the rights on your directory to -rwxr-x---
if you want that the "world" and "any user in your group"can not see your directory structure,
you have to change the rights on your directory to -rwx------

Just put those permissions on your directory and no one can see your files.

I hope this helps


Marcel

[Wodisch]

Hi,
if you are using VxFS (Veritas or Journaled File Systems)
then you need to install the JFS3.3 (and exchange the
two drivers with a single new one in your kernel).
AND then the commands are NOT "lsacl" and "chacl"
any more, but "getacl" and "setacl" and a different
syntax.
HTH,
Wodisch