{"id":19586,"date":"2017-06-07T06:20:30","date_gmt":"2017-06-06T22:20:30","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/06\/07\/acl-%e6%ac%8a%e9%99%90\/"},"modified":"2021-03-18T17:25:03","modified_gmt":"2021-03-18T09:25:03","slug":"acl-%e6%ac%8a%e9%99%90","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/06\/07\/acl-%e6%ac%8a%e9%99%90\/","title":{"rendered":"acl \u6b0a\u9650"},"content":{"rendered":"

ACL \u662f Access Control List \u7684\u7e2e\u5beb\uff0c\u4e3b\u8981\u7684\u76ee\u7684\u5728\u65bc\u89e3\u6c7a Linux \u50b3\u7d71\u53ea\u80fd\u4ee5 owner,group,others \u7684 read,write,execute \u4f86\u8a2d\u5b9a\u6a94\u6848\u6216\u76ee\u9304\u7684\u6b0a\u9650\u3002\u3002ACL \u53ef\u4ee5\u91dd\u5c0d\u55ae\u4e00\u4f7f\u7528\u8005\uff0c\u55ae\u4e00\u6a94\u6848\u6216\u76ee\u9304\u4f86\u9032\u884c r,w,x \u7684\u6b0a\u9650\u8a2d\u5b9a\uff0c\u4f7f\u7528\u5f48\u6027\u975e\u5e38\u5927\uff0c\u4e5f\u66f4\u52a0\u9748\u6d3b\u3002
\u53c3\u8003\u7db2\u9801\uff1a
\u9ce5\u54e5\u7684 Linux \u79c1\u623f\u83dc — \u7b2c\u5341\u4e09\u7ae0\u3001Linux \u5e33\u865f\u7ba1\u7406\u8207 ACL \u6b0a\u9650\u8a2d\u5b9a<\/a><\/p>\n

1. \u65b0\u589e\u4e09\u500b\u6e2c\u8a66\u5e33\u865f
# useradd usera -d \/home\/usera<\/span>
# useradd userb -d \/home\/userb<\/span>
# useradd userc -d \/home\/userc<\/span>
# chmod 755 \/home\/user?<\/span><\/p>\n

2. \u5207\u63db\u5e33\u865f usera
# su – usera<\/span><\/p>\n

3. \u5efa\u7acb\u6e2c\u8a66\u6a94\u6848\u53ca\u76ee\u9304
$ touch acl_test_file<\/span>
$ mkdir acl_test_dir<\/span>
$ ll<\/span>
drwxrwxr-x 2 usera usera 4096 Mar 12 23:24 acl_test_dir\/<\/span>
-rw-rw-r– 1 usera usera\u00a0\u00a0\u00a0 0 Mar 12 23:21 acl_test_file<\/span>
\u76ee\u9304 775\u00a0<\/span> \u6a94\u6848\u662f 664<\/span>[@more@]
4. \u8a2d\u5b9a\u6a94\u6848\u6b0a\u9650\u53ca\u67e5\u770b
$ setfacl -m u:userb:rx acl_test_file<\/span>
$ getfacl acl_test_file<\/span>
# file: acl_test_file<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rw-<\/span>
user:userb:r-x<\/span>
group::rw-<\/span>
mask::rwx<\/span>
other::r–<\/span><\/p>\n

$ setfacl -m u:userb:x acl_test_file<\/span>
$ getfacl acl_test_file<\/span>
# file: acl_test_file<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rw-<\/span>
user:userb:–x<\/span>
group::rw-<\/span>
mask::rwx<\/span>
other::r–<\/span><\/p>\n

$ setfacl -m u:userb:r acl_test_file<\/span>
$ getfacl acl_test_file<\/span>
# file: acl_test_file<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rw-<\/span>
user:userb:r–<\/span>
group::rw-<\/span>
mask::rw-<\/span>
other::r–<\/span><\/p>\n

$ setfacl -m u:userb:r,u:userc:rwx acl_test_file<\/span>
$ getfacl acl_test_file<\/span>
# file: acl_test_file<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rw-<\/span>
user:userc:rwx<\/span>
user:userb:r–<\/span>
group::rw-<\/span>
mask::rwx<\/span>
other::r–<\/span><\/p>\n

$ setfacl -m u:userb:—,u:userc:rwx acl_test_file<\/span>
$ getfacl acl_test_file<\/span>
# file: acl_test_file<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rw-<\/span>
user:userc:rwx<\/span>
user:userb:—<\/span>
group::rw-<\/span>
mask::rwx<\/span>
other::r–<\/span><\/p>\n

userb \u7121\u6cd5\u5b58\u53d6 acl_test_file
# su – userb<\/span>
$ cat acl_test_file<\/span>
cat: acl_test_file: Permission denied<\/span><\/p>\n

userc \u53ef\u4ee5\u5b58\u53d6 acl_test_file
# su – userc<\/span>
$ echo 1 > acl_test_file<\/span>
$ cat acl_test_file<\/span>
1<\/span><\/p>\n

5. \u8a2d\u5b9a\u7fa4\u7d44
$\u00a0setfacl -m g:userc:rwx acl_test_file<\/span>
$ getfacl acl_test_file<\/span>
# file: acl_test_file<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rw-<\/span>
user:testuser:rwx<\/span>
user:userb:—<\/span>
group::rw-<\/span>
group:userb:rwx<\/span>
mask::rwx<\/span>
other::r–<\/span><\/p>\n

6. \u8a2d\u5b9a mask
$\u00a0setfacl -m m:r acl_test_file<\/span>
$ getfacl acl_test_file<\/span>
# file: acl_test_file<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rw-<\/span>
user:userc:rwx\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #effective:r–<\/span>
user:userb:—<\/span>
group::rw-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #effective:r–<\/span>
group:userb:rwx\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #effective:r–<\/span>
mask::r–<\/span>
other::r–<\/span><\/p>\n

\u96d6\u7136 userc \u5c0d acl_test_file \u6709 rwx \u6b0a\u9650\uff0c\u4f46\u548c mask \u7d44\u5408\u8d77\u4f86\u4e4b\u5f8c\uff0c\u53ea\u5269\u4e0b -r \u6b0a\u9650
# su – userc<\/span>
$ echo 234 > acl_test_file<\/span>
-bash: acl_test_file: Permission denied<\/span>
$ cat acl_test_file<\/span>
1<\/p>\n

7. \u8a2d\u5b9a\u76ee\u9304
$ setfacl -m u:userb:rwx acl_test_dir<\/span>
$ getfacl acl_test_dir<\/span>
# file: acl_test_dir<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rwx<\/span>
user:userb:rwx<\/span>
group::rwx<\/span>
mask::rwx<\/span>
other::r-x<\/span><\/p>\n

# su – userb<\/span>
$ cd \/home\/usera\/acl_test_dir<\/span>
$ mkdir 123<\/span>
$ getfacl 123<\/span>
# file: 123<\/span>
# owner: userb<\/span>
# group: userb<\/span>
user::rwx<\/span>
group::rwx<\/span>
other::r-x<\/span><\/p>\n

\u53ea\u6709\u4e00\u822c\u7684\u6b0a\u9650\uff0c\u6c92\u6709 acl \u9810\u8a2d\u6b0a\u9650<\/p>\n

$ setfacl -m d:u:userb:rx acl_test_dir<\/span>
$ getfacl acl_test_dir<\/span>
# file: acl_test_dir<\/span>
# owner: usera<\/span>
# group: usera<\/span>
user::rwx<\/span>
user:userb:rwx<\/span>
group::rwx<\/span>
mask::rwx<\/span>
other::r-x<\/span>
default:user::rwx<\/span>
default:user:userb:r-x<\/span>
default:group::rwx<\/span>
default:mask::rwx<\/span>
default:other::r-x<\/span><\/p>\n

# su – userb<\/span>
$ cd \/home\/usera\/acl_test_dir<\/span>
$ mkdir 234<\/span>
$ getfacl 234<\/span>
# file: 234<\/span>
# owner: userb<\/span>
# group: userb<\/span>
user::rwx<\/span>
user:userb:r-x<\/span>
group::rwx<\/span>
mask::rwx<\/span>
other::r-x<\/span>
default:user::rwx<\/span>
default:user:userb:r-x<\/span>
default:group::rwx<\/span>
default:mask::rwx<\/span>
default:other::r-x<\/span><\/p>\n

$ ll<\/span>
drwxrwxr-x\u00a0 2 userb userb 4096 Mar 12 23:53 123\/<\/span>
drwxrwxr-x+ 2 userb userb 4096 Mar 12 23:59 234\/<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

ACL \u662f Access Control List \u7684\u7e2e\u5beb\uff0c\u4e3b\u8981\u7684\u76ee\u7684\u5728\u65bc\u89e3\u6c7a Linux \u50b3\u7d71\u53ea\u80fd\u4ee5 own … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008acl \u6b0a\u9650\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117],"tags":[],"class_list":["post-19586","post","type-post","status-publish","format-standard","hentry","category-c-78462"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["688427"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19586"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19586"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19586\/revisions"}],"predecessor-version":[{"id":21092,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19586\/revisions\/21092"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}