How To Allow/Permit User To Access A Specific File or Folder In Linux Using ACL

https://www.2daygeek.com/how-to-configure-access-control-lists-acls-setfacl-getfacl-linux

When you are come to file or folder permission part, you may first look owner/group/others permission. This can be done through chmod, chown, etc., commands.
Files and directories have permission sets such as owner (owner or user of the file), group (associated group) and others. However, these permission sets have limitations and doesn’t allow users to set different permissions to different users.
By default Linux has following permission set for files & folders.
Files -> 644 -> -rw-r–r– (User has Read & Write access, Group has Read only access, and Others also has Read only access)
Folders -> 755 -> drwxr-xr-x (User has Read, Write & Execute access, Group has Read & Execute access, and Others also has the same access)
For example: By default users can access & edit their own home directory files, also can access associated group files but they can’t modify those since group doesn’t has write access and it’s not advisable to permit group level. Also he/she can’t access other users files. In some case multiple users want to access the same file, what will be the solution?
I have user called magi and he wants to modify httpd.conf file? how to grant since it’s owned by root user. Thus, Access Control Lists (ACLs) were implemented.

What Is ACL?

ACL stands for Access Control List (ACL) provides an additional, more flexible permission mechanism for file systems. It is designed to assist with UNIX file permissions. ACL allows you to give permissions for any user or group to any disc resource. setfacl & getfacl commands help you to manage AcL without any trouble.

What Is setfacl?

setfacl is used to sets Access Control Lists (ACLs) of files and directories.

What Is getfacl?

getfacl – get file access control lists. For each file, getfacl displays the file name, owner, the group, and the Access Control List (ACL). If a directory has a default ACL, getfacl also displays the default ACL.

How to check whether ACL is enabled or not?

Run tune2fs command to Check whether ACL is enabled or not.

# tune2fs -l /dev/sdb1 | grep options
Default mount options:    (none)

The above output clearly shows that ACL is not enabled for /dev/sdb1 partition.
If acl is not listed then you will need to add acl as a mount option. To do so persistently, change the /etc/fstab line for /app to look like this.

# more /etc/fstab

UUID=f304277d-1063-40a2-b9dc-8bcf30466a03 /     ext4    defaults            1 1
/dev/sdb1               		  /app  ext4    defaults,acl        1 1

Or alternatively, you can add this to the filesystem superblock by using the following command.

# tune2fs -o +acl /dev/sdb1

Now, change the option in the current run-time without interruption by running the following command.

# mount -o remount,acl /app

Then run the tune2fs command again to see acl as an option.

# tune2fs -l /dev/sdb1 | grep options
Default mount options:    acl

Yes, now i can see the ACLs option on /dev/sdb1 partition.

How to check default ACL values

To check the default ACL values for a file or directory, use the getfacl command followed by /path to file or /path to folder. Make a note, when you run getfacl command on non ACLs file or folder, it wont shows additional user and mask parameter values.

# getfacl /etc/apache2/apache2.conf

# file: etc/apache2/apache2.conf
# owner: root
# group: root
user::rw-
group::r--
other::r--

How to Set ACL for files

Run the setfacl command with below format to set ACL on the given file. In the below example we are going to give a rwx access to magi user on the /etc/apache2/apache2.conf file.

# setfacl -m u:magi:rwx /etc/apache2/apache2.conf

Details :

• setfacl: Command
• -m: modify the current ACL(s) of file(s)
• u: Indicate a user
• magi: Name of the user
• rwx: Permissions which you want to set
• /etc/apache2/apache2.conf: Name of the file

Run the command once again to view the new ACL values.

# getfacl /etc/apache2/apache2.conf

# file: etc/apache2/apache2.conf
# owner: root
# group: root
user::rw-
user:magi:rwx
group::r--
mask::rwx
other::r--

Make a note : If you noticed a plus (+) sign after the file or folder permissions then it’s ACL setup.

# ls -lh /etc/apache2/apache2.conf
-rw-rwxr--+ 1 root root 7.1K Sep 19 14:58 /etc/apache2/apache2.conf

How to Set ACL for folders

Run the setfacl command with below format to set ACL on the given folder recursively. In the below example we are going to give a rwx access to magi user on the /etc/apache2/sites-available/ folder.

# setfacl -Rm u:magi:rwx /etc/apache2/sites-available/

Details :

• -R: Recurse into sub directories

Run the command once again to view the new ACL values.

# getfacl /etc/apache2/sites-available/

# file: etc/apache2/sites-available/
# owner: root
# group: root
user::rwx
user:magi:rwx
group::r-x
mask::rwx
other::r-x

Now, all the files and folders having ACLs values under /etc/apache2/sites-available/ folder.

# ls -lh /etc/apache2/sites-available/
total 20K
-rw-rwxr--+ 1 root root 1.4K Sep 19 14:56 000-default.conf
-rw-rwxr--+ 1 root root 6.2K Sep 19 14:56 default-ssl.conf
-rw-rwxr--+ 1 root root 1.4K Dec  8 02:57 mywebpage.com.conf
-rw-rwxr--+ 1 root root 1.4K Dec  7 19:07 testpage.com.conf

How to Set ACL for group

Run the setfacl command with below format to set ACL on the given file. In the below example we are going to give a rwx access to appdev group on the /etc/apache2/apache2.conf file.

# setfacl -m g:appdev:rwx /etc/apache2/apache2.conf

Details :

• g: Indicate a group

For multiple users and groups, just add comma between the users or group like below.

# setfacl -m u:magi:rwx,g:appdev:rwx /etc/apache2/apache2.conf

How to remove ACL

Run the setfacl command with below format to remove ACL for the given user on the file. This will remove only user permissions and keep mask values as read.

# setfacl -x u:magi /etc/apache2/apache2.conf

Details :

• -x: Remove entries from the ACL(s) of file(s)

Run the command once again to view the removed ACL values. In the below output i can see the mask values as read.

# getfacl /etc/apache2/apache2.conf

# file: etc/apache2/apache2.conf
# owner: root
# group: root
user::rw-
group::r--
mask::r--
other::r--

Use -b option to remove all ACLs associated to a file.

# setfacl -b /etc/apache2/apache2.conf

Details :

• -b: Remove all extended ACL entries

Run the command once again to view the removed ACL values. Here everything is gone and there is no mask value also.

# getfacl /etc/apache2/apache2.conf

# file: etc/apache2/apache2.conf
# owner: root
# group: root
user::rw-
group::r--
other::r--

How to Backup and Restore ACL

Run the following command to backup and restore ACLs values. To take a backup, navigate to corresponding directory and do it.
We are going to take a backup of sites-available folder. So, you have to do like below.

# cd /etc/apache2/sites-available/
# getfacl -R * > acl_backup_for_folder

To resote, run the following command.

# setfacl --restore=/etc/apache2/sites-available/acl_backup_for_folder