O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 5] 5.2 Using File Permissions
To copy an ACL from one file to a group of files, use xargs:
$ ls *.dat *.old | xargs -i /bin/sh -c "aclget silver | aclput {}"
These commands copy the ACL in silver to all the files ending in .dat and .old in the current directory.
You can use the ls -le command to quickly determine whether a file has an extended permissions set or not:
$ ls -le *_acl
-rw-r-----+ 1 chavez chem 51 Mar 20 13:27 has_acl
-rwxrws---- 2 chavez chem 512 Feb 08 17:58 no_acl
The plus sign appended to the normal mode string indicates the presence of extended permissions; the minus sign is present
otherwise.
5.2.5.2 HP-UX access control lists
The lsacl command can be used to view the access control list for a file. For a file having only normal UNIX file modes set, the
output looks like this:
(chavez.%,rw-)(%.chem,r--)(%.%,---) bronze
This example shows the format an ACL takes under HP-UX. Each parenthesized item is known as an access control list entry,
although we're going to call them "entries." The percent sign character ("%") is a wildcard within an entry, and the three entries
in the previous listing specify the access for user chavez as a member of any group, for any user in group chem, and for all other
users and groups, respectively.
A file can have up to 16 access control list entries: three base entries corresponding to normal file modes and up to 13 optional
entries. Here is the access control list for another file (generated this time by lsacl -l):
silver:
rwx chavez.%
r-x %.chem
r-x %.phys
r-x hill.bio
rwx harvey.%
--- %.%
This ACL grants every access to user chavez with any current group membership (she is the file owner). It grants read and
execute access to members of the chem and phys groups; it grants read and execute access to user hill, if hill is a member of
group bio; it grants user harvey read, write, and execute access regardless of his group membership; and it grants no access to
any other user or group.
Entries within an HP-UX access control list are examined in order of decreasing specificity: entries with a specific user and
group are considered first; those with only a specific user follow; ones with only a specific group are next; and the other entries
are last of all. Within a class, entries are examined in order. When determining whether or not to permit file access, the first
applicable entry is used. Thus, user harvey will be given write access to the file silver even if he is a member of the chem or phys
group.
The chacl command is used to modify the access control list for a file. ACLS can be specified to chacl in two distinct forms: as a
list of entries or via a chmod-like syntax. By default, chacl adds entries to the current ACL. For example, these two commands
add to the file server's ACL read access for the bio group and read and execute access for user hill:
$ chacl "(%.bio,r--) (hill.%,r-x)" silver
$ chacl "%.bio = r, hill.% = rx" silver
In either format, the access control list must be passed to chacl as a single argument. The second format also includes + and -
operators as in chmod. For example, this command adds read access for group chem and user harvey, and removes write access
for group chem, adding or modifying ACL entries as needed:
$ chacl "%.chem -w+r, harvey.% +r" silver
chacl's -r option can be used to replace the current ACL:
$ chacl -r "@.% = 7, %.@ = rx, %.bio = r, %.% = " *.dat
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch05_02.htm (8 of 9) [2002-04-12 10:44:09]