Working with Access Control Lists
On the List

© IKO, Fotolia
The ancient Linux permission system is often insufficient for complex production environments. Access Control Lists offer a flexible alternative.
Alice appreciates the convenience of a PC-based electronic calendar, but to maintain her privacy, she has set strict permissions for her calendar file: She can add new appointments herself, but other members of her workgroup have read-only access. Others outside of her workgroup are not even allowed to look.
This configuration is fine at first, but one day Bob from another department agrees to collaborate with Alice. To allow this to happen, she has to give him access to her calendar data.
In this scenario, it is clear that the legacy Linux permission system has outlived its usefulness. To allow Bob to read the file with her calendar data, Alice can ask the administrator to move the new colleague into her own group, but this would allow Bob to view all the other documents produced by Alice's team. Another approach would be to temporarily set up a completely new user group with both Alice's and Bob's accounts as members. In this simple scenario, a temporary group might be an acceptable solution, but in a real-world enterprise environment, group management becomes far more complicated, and the habit of creating temporary groups on the fly can lead to too many groups with no good way of tracking them.
Access Control Lists, or ACLs for short, promise a solution. They add flexible access control to the legacy Unix permissions system, letting users add permissions for any group or users. Alice doesn't even need to talk to the administrator; she can simply put Bob on the list of authorized users and even specify default permissions for all new files.
Access Control Lists have been around for a while, and they are gradually becoming part of daily life in many production environments; however, the ACL security structure is still unfamiliar to many Linux users. In this article, I show you how to get started with ACLs in Linux.
Rotating Disks
If you plan to use ACLs, your filesystem must support extended attributes. Of the current crop of filesystems, Ext2, Ext3, Ext4, ReiserFS, JFS, and XFS all have ACL support. JFS and XFS support extended attributes by default; for all others, you need to stipulate the acl mount option to enable ACLs:
mount -o remount,acl,defaults mount_point
Most current distributions set these parameters by default in /etc/fstab:
/dev/hda1 / ext3 acl,user_xattr 1 1
For internal disks, you need not change anything, and ACLs also work over NFS as of NFSv3, assuming the server has a filesystem and operating system that support ACLs.
Kernel Issues
Besides the filesystem, the kernel also must support ACLs – after all, it is the kernel that finally grants or refuses access to a file. All current kernels in the 2.6 series have ACL support, and patches exist for the legacy 2.4.x kernel. The major distributions typically enable extended attributes for all of the filesystems mentioned previously, allowing users to start assigning permissions from scratch. To be sure, just enter the following command:
grep "XATTR\|POSIX_ACL" /boot/config-$(uname -r)
It should show two entries with =y if ACLs are supported. Ext2, for example, would show:
CONFIG_EXT2_FS_XATTR=y CONFIG_EXT2_FS_POSIX_ACL=y
Otherwise, you have no alternative but to install a new kernel.
Band of Two
Besides filesystem and Linux kernel support, you also need a package with applications that display the ACLs for each file and modify them as needed. Most distributions include a package called acl for this purpose. Two of the programs it includes are particularly useful:
- getfacl displays the ACL for a file, and
- setfacl sets or changes the permissions for a file
Both tools rely on the libattr and libacl libraries, which many distros install by default.
POSIX and ACLs
You might stumble across the term POSIX (Portable Operating System Interface) ACLs on the Internet and in documentation. Although various drafts appeared at the end of the last century (POSIX 1003.1e, commonly referred to as POSIX.1e, and 1003.2c), for several reasons, the drafts were never approved. Most ACL implementations are still oriented on these drafts. To underline the close connection, many authors use the term POSIX ACLs [1].
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
Fedora 39 Beta is Now Available for Testing
For fans and users of Fedora Linux, the first beta of release 39 is now available, which is a minor upgrade but does include GNOME 45.
-
Fedora Linux 40 to Drop X11 for KDE Plasma
When Fedora 40 arrives in 2024, there will be a few big changes coming, especially for the KDE Plasma option.
-
Real-Time Ubuntu Available in AWS Marketplace
Anyone looking for a Linux distribution for real-time processing could do a whole lot worse than Real-Time Ubuntu.
-
KSMBD Finally Reaches a Stable State
For those who've been looking forward to the first release of KSMBD, after two years it's no longer considered experimental.
-
Nitrux 3.0.0 Has Been Released
The latest version of Nitrux brings plenty of innovation and fresh apps to the table.
-
Linux From Scratch 12.0 Now Available
If you're looking to roll your own Linux distribution, the latest version of Linux From Scratch is now available with plenty of updates.
-
Linux Kernel 6.5 Has Been Released
The newest Linux kernel, version 6.5, now includes initial support for two very exciting features.
-
UbuntuDDE 23.04 Now Available
A new version of the UbuntuDDE remix has finally arrived with all the updates from the Deepin desktop and everything that comes with the Ubuntu 23.04 base.
-
Star Labs Reveals a New Surface-Like Linux Tablet
If you've ever wanted a tablet that rivals the MS Surface, you're in luck as Star Labs has created such a device.
-
SUSE Going Private (Again)
The company behind SUSE Linux Enterprise, Rancher, and NeuVector recently announced that Marcel LUX III SARL (Marcel), its majority shareholder, intends to delist it from the Frankfurt Stock Exchange by way of a merger.