标签：linux_facl
文件系统访问控制列表:
FACL: FILEsystemAccess Control List
利用文件扩展属性保存额外控制权限
setfacl 设置facl
-m设定额外的访问控制列表
u:UID:perm
用户lisi创建一个文件，让zhangsan可以编辑但其他用户不能编辑
[lisi@localhosttmp]$ touch aaa
[lisi@localhosttmp]$ ls -l
总用量 0
-rw-rw-r--. 1lisi lisi 0 5月 26 08:45 aaa
[lisi@localhosttmp]$ setfacl -m u:zhangsan:rw- aaa
[lisi@localhosttmp]$ getfacl aaa
# file: aaa
# owner: lisi
# group: lisi
user::rw-
user:zhangsan:rw-
group::rw-
mask::rw-
other::r—
[root@localhosttmp]# su – zhangsan
[zhangsan@localhosttmp]$ vi aaa
[zhangsan@localhosttmp]$ ls -l
总用量 8
-rw-rw-r--+ 1lisi lisi 8 5月 26 08:48 aaa
g:GID:perm
[lisi@localhost tmp]$ setfacl -m g:zhangsanaaa
setfacl: Option -m incomplete
[lisi@localhost tmp]$ setfacl -mg:zhangsan:rwx aaa
[lisi@localhost tmp]$ getfacl aaa
# file: aaa
# owner: lisi
# group: lisi
user::rw-
group::rw-
group:zhangsan:rwx
mask::rwx
other::r—
[root@localhost ~]# usermod -a -G zhangsanwangwu
[root@localhost ~]# id wangwu
uid=502(wangwu) gid=502(wangwu) 组=502(wangwu),500(zhangsan)
[root@localhost~]# su - wangwu
[wangwu@localhost ~]$ cd /tmp
[wangwu@localhost tmp]$ getfacl aaa
# file: aaa
# owner: lisi
# group: lisi
user::rw-
group::rw-
group:zhangsan:rwx
mask::rwx
other::r—
[wangwu@localhost tmp]$ vi aaa
[wangwu@localhost tmp]$ ls -l
总用量 12
-rw-rwxr--+ 1 lisi lisi 16 5月 26 09:46 aaa
-rw-rwxr--+ 1 wangwu wangwu 0 5月 26 09:20 bbb
[root@localhost tmp]# su - wangwu
[wangwu@localhost ~]$ cd /tmp
[wangwu@localhost tmp]$ vi aaa
[wangwu@localhost tmp]$ id wangwu
uid=502(wangwu) gid=502(wangwu) 组=502(wangwu),500(zhangsan)
由此说明只要给文件添加组的facl 无论是附加组还是基本组都能有facl的权限
-x 取消设定
getfacl获取facl信息
mask 最大权限，无论给了什么权限都无法超出 mask权限
[root@localhost ~]#setfacl -m mask:rw /tmp/aaa
[root@localhost ~]#getfacl /tmp/aaa
getfacl: Removingleading ‘/‘ from absolute path names
# file: tmp/aaa
# owner: root
# group: root
user::rw-
user:lisi:rwx #effective:rw-
group::r--
mask::rw-
other::r—
setfacl -x u:rwx user1 取消facl用户权限
setfacl -x g:rwx user2 取消facl组权限
setfacl -m d:u:user1:rwx /tmp/aaa 设定目录facl，在目录里新建的文件也继承facl权限
setfacl -m d:g:user1:rwx /tmp/aaa
[root@localhost ~]#setfacl -m d:u:lisi:rwx /tmp/bbb
[root@localhost ~]#getfacl /tmp/bbb
getfacl: Removingleading ‘/‘ from absolute path names
# file: tmp/bbb
# owner: root
# group: root
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:lisi:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
setfacl -x d:u:lisi/tmp/bbb 取消
[root@localhost ~]#setfacl -x d:u:lisi /tmp/bbb
[root@localhost ~]#getfacl /tmp/bbb
getfacl: Removingleading ‘/‘ from absolute path names
# file: tmp/bbb
# owner: root
# group: root
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::r-x
default:mask::r-x
default:other::r-x
本文出自 “linux运维” 博客，谢绝转载！
标签：linux_facl
原文地址：http://coolcl.blog.51cto.com/4514424/1788901
