linux-ACL(访问控制列表)权限管理

一、访问控制列表

image.png
image.png

1.1、setfacl命令

[root@localhost /home/data]#whatis setfacl
setfacl (1)          - set file access control lists
[root@localhost /home/data]#setfacl --help
setfacl 2.2.51 -- set file access control lists
Usage: setfacl [-bkndRLP] { -m|-M|-x|-X ... } file ...
  -m, --modify=acl        modify the current ACL(s) of file(s)
  -M, --modify-file=file  read ACL entries to modify from file
  -x, --remove=acl        remove entries from the ACL(s) of file(s)
  -X, --remove-file=file  read ACL entries to remove from file
  -b, --remove-all        remove all extended ACL entries
  -k, --remove-default    remove the default ACL
      --set=acl           set the ACL of file(s), replacing the current ACL
      --set-file=file     read ACL entries to set from file
      --mask              do recalculate the effective rights mask
  -n, --no-mask           don't recalculate the effective rights mask
  -d, --default           operations apply to the default ACL
  -R, --recursive         recurse into subdirectories
  -L, --logical           logical walk, follow symbolic links
  -P, --physical          physical walk, do not follow symbolic links
      --restore=file      restore ACLs (inverse of `getfacl -R')
      --test              test mode (ACLs are not modified)
  -v, --version           print version and exit
  -h, --help              this help text

[root@localhost /home/data]#ll
total 4
-rw-r----- 1 root   root   465 Jul  3 17:54 a.txt
-rw-rw-r-- 1 missbe missbe   0 Jul  3 18:04 b.txt
-rw-r--r-- 1 unnet  unnet    0 Jul  3 17:29 c.txt
[root@localhost /home/data]#setfacl -m u:missbe:- c.txt 
[root@localhost /home/data]#su missbe
[missbe@localhost /home/data]$cat c.txt 
cat: c.txt: Permission denied

1.2、getfacl命令

[missbe@localhost /home/data]$whatis getfacl
getfacl (1)          - get file access control lists
[missbe@localhost /home/data]$getfacl --help
getfacl 2.2.51 -- get file access control lists
Usage: getfacl [-aceEsRLPtpndvh] file ...
  -a,  --access           display the file access control list only
  -d, --default           display the default access control list only
  -c, --omit-header       do not display the comment header
  -e, --all-effective     print all effective rights
  -E, --no-effective      print no effective rights
  -s, --skip-base         skip files that only have the base entries
  -R, --recursive         recurse into subdirectories
  -L, --logical           logical walk, follow symbolic links
  -P, --physical          physical walk, do not follow symbolic links
  -t, --tabular           use tabular output format
  -n, --numeric           print numeric user/group identifiers
  -p, --absolute-names    don't strip leading '/' in pathnames
  -v, --version           print version and exit
  -h, --help              this help text

[missbe@localhost /home/data]$getfacl c.txt 
# file: c.txt
# owner: unnet
# group: unnet
user::rw-
user:missbe:---
group::r--
mask::r--
other::r--

image.png
image.png

mask类似掩码，user、group的权限不能高于mask的权限[类似于掩码异或]