linuxexpert-practice-labs/labs/lfcs/5-4-acls/README.md

LFCS 5.4: ACLs

Giving extra users and groups access with access control lists, default ACLs for new files, the mask, and copying files with their ACLs.

Before you start

The lab creates these users (password Lab-Pass-1): alice, bob in group finance, and dana and eve in group devs. It sets up:

• /srv/reports, group finance, with two reports in it;
• /srv/project, group devs, with files of the team, some of which already have ACLs;
• /srv/shared/plan.txt, which has an ACL entry giving alice read and write access, but someone has since run chmod 640 on it.

The acl tools (getfacl, setfacl) are installed.

Tasks

1. Give user alice read and write access to /srv/reports and the files in it, without changing their group or adding alice to it.
2. Make every new file in /srv/project writable by group devs, whatever the creator's umask.
3. alice can no longer write to /srv/shared/plan.txt, although her ACL entry says rw-. Find out why, and write the name of the ACL entry that causes it to /root/lab-answers/3. Then fix it without removing alice's entry.
4. Copy /srv/project to /backup/project with its ACLs (do this after task 2). Test it by comparing getfacl -R . run in each directory; on XFS the copy may list the same files in a different order.

Hints

• getfacl, setfacl -m u:NAME:PERMS, -R, and capital X.
• setfacl -d; test with sudo -u eve bash -c 'umask 077; touch FILE'.
• #effective: in getfacl; setfacl -m m::....
• cp -a, rsync -aA or tar --acls.