Instructor: Now since we are on the topic
of assigning permission to files and directories
and changing groups and ownership,
we have to look into Access Control List as well.
Access Control List is another layer,
or I would say a top layer or additional layer
that runs on top of your permissions
which allows you to assign permission per user.
So what is ACL?
ACL stands for Access Control List
which provides an additional
more flexible permission mechanism for file systems.
It is designed to assist with UNIX file permissions.
ACL allows you to give permission
for any user or group to any disc resources.
The use of ACL, what is the purpose?
Think of a scenario
in which a particular user is not a member
of a group created by you.
So, let's say if you create a user A, B, C,
and it's not member of the group route,
but you still want to give some read or write access.
How can you do it
without making the user member of the group?
And that's where we have Access Control List
which will help us do it.
So, let me put it in a very simple words one more time.
So, let's say if you wanted to allow a file
that is created by root
and allow that user to read that file.
Now, that user is a regular user,
not part of the group root,
and you want that user to read that file.
So of course the one way to do it is you change
the read permission of others,
the last three bits,
so others can read it,
but then all everyone else could read that.
But, we only want one user to read that
instead of all other users to read it.
That is why we only give permission
to that particular user using ACL.
Hope that clarifies.
So basically, ACLs are used to make
a flexible permission mechanism in Linux.
From Linux man pages ACLs are used to define
more fine-grain discretionary access rights
for files and directories.
The commands to assign and remove ACL permissions are
setfacl and getfacl.
So, set file ACL, get file ACL.
Get file ACL will give you the information
about the existing permissions of a file.
And set will allow you to set the way
you want it to set.
Let's look at a few examples.
Here are the list of commands for setting up ACLs.
To add permission for a user,
you have to run a command set file ACL
with minus n option to modify U for user,
and then you have to separate it with the colons
where user is a your user name.
In my case it will be iafzal.
And then column and the permission
that you wanted to give that user to.
And then of course, the last part is the file name.
Which file do you want to give the permission to?
Make sure you specify the complete absolute path.
To add permission for a group,
you could also allow the permission to a specific group.
So again, if you give permission,
let's say to read permission to the group,
the middle three bits,
then every group in your Linux system can read it.
But what if you only want one group to read it, right?
That could be a problem.
So then again, Access Control List comes to the rescue.
And to add that group to allow it to read
or write that specific file, you have to set with G
and group name and the permissions.
To allow all files or directories to inherit ACL entries
from the directory,
it is within meaning cascading,
which will be set with minus dm option
and then entry whatever that you wanna put in
and the name of the file or directory.
Sorry, of course the directory,
because you want it to cascade.
A file cannot have a file within itself,
so that's why directory would have to have that.
To remove a specific entry,
you will have to do setfacl with minus X to remove it,
and then you will have to specify the user
and the name of the file.
This is only for a specific user.
Now let's say if you want to remove
all the ACL permissions from everyone.
Then you have to do setfacl
with minus B option and the name of the file.
Couple of things that you need to remember.
One is as you assign the ACL permission
to a file or directory,
you will see that it will add a plus sign
at the end of the permission.
So, when you run LS minus L,
the first column which shows you the permissions,
it adds the plus sign at the end of it
which shows that it has ACL assigned to it.
The second thing is setting with W permission
with ACL does not allow you to remove a file.
So, you could modify the file, edit the file,
but you cannot delete that file.
That is something that still the user keeps
the permission to itself to delete it.
So now let's get into our Linux machine,
and we'll try a couple of these commands to learn
how we could set ACL permissions
to a file that is owned by someone else.
I am logged in as my as root,
and of course you can always check the root has
a pound or hash sign to it.
But again, always make sure.
Make sure you are on the right computer,
and I am on my right machine.
I am in my temp directory, and I'm going to create a file.
Let's say I'm gonna call it Texas,
and I'm gonna pick just TX as an acronym.
Let's make sure it is created and has the write permission.
As you could see, it is created owned by root
and owned by group root.
And the owner can read write.
The group can only read, and others can only read.
If you do getfacl on the file,
you will see more information again.
File is this owner group,
the user permission group permission or the permission.
Now comes to a part where you want to allow everyone,
sorry, where you want to allow
only iafzal to write to that file.
Then iafzal, as you know, counts
or considers as other, right?
Iafzal falls in this category.
So, if you give write here
if you give that permission as W right here,
then what will happen, everyone else can write to that file.
So again, I hope you understand where I'm getting at.
So to overcome this problem
where only one user can modify that file
then you'll assign it as a setfacl.
So do setfacl minus M to modify
your permissions U for user.
Who's the user? Iafzal.
And what permission you wanna give?
You wanna give read and write.
And the name of the file would be tmp,
and the file name is Texas.
But, before we run it I just want to go in and start,
sorry, not this.
I wanna go in and start a duplicate session,
and I wanna log in as iafzal.
Right now if I do CD, temp and cat Texas,
there is nothing in there.
By the way, first of all, sorry not cat,
because everyone could read it,
so I shouldn't have a problem.
But what if I wanted to edit it?
So VI TEXAS.
It says at the bottom right here, "read only."
So, even if I put in something,
hello or whatever that you wanna put and save it,
it will tell me I can't open the file.
It's not editable.
I do not have permission, so I cannot do it.
If when I run this command get file ACL,
sorry, set file ACL with iafzal with read as well
and write as well for that file, hit enter.
Now, to verify it,
if it actually has set those permission,
you do getfacl, tmp TX.
And you will see right now, right here
it says user iafzal has that right to modify it.
Now, if I do VI Texas now,
you see I do not have that same error
that I was getting it before.
I could just put in anything I want, Hello Texas.
Oops, hello Texas.
Save it and it lets me save it.
And when I do cat on Texas, I am able to do that text.
So, that's why these ACL are so important to assign
that specific permission to a specific user.
Same thing, if you wanted to do that group assignment
to the permission,
you'd run the same command,
but instead of U, you put in G, and hit enter.
And when you do getfacl, you will see
now group iafzal also can modify this file.
So, if a user is part of my group,
they could actually go in and modify that file.
Going to number four,
the number three one is to actually assign those permissions
and cascade down to every file and directory
which is very simple.
So, I'll jump right into number four.
To remove that specific permissions
I will have to do set file ACL minus X,
and what are you taking out?
You're taking out the user iafzal's permission.
And for that, you have to type the file name,
run getfacl, and you'll see that iafzal user is gone.
But, what if you want to remove everything, not just user,
but every permission for every user
or any every group,
then you will have to run the command,
set file ACL as minus B option.
And now, when you do getfacl,
you'll see it's back to its original state.
That's how it works.
And when I said you cannot delete,
even though I do have the right permission
to write to the file, edit that file, I cannot delete that.
So, if I do RM Texas,
by the way I have to give the permission back again.
This is the permission.
Let's verify it again.
Yes, I do have permission to read and write to it.
So, if I try to remove it,
it will say operation not permitted.
So, the reason I'm including that,
so I don't want you to waste your time by,
you know, trying to delete that file and thinking,
hey I do have the right permission,
but why can I not delete it?
The reason that ACL does not put that in there.
So, it only gives that right to only the user,
just in case by accident that user deletes that file.
So, that's how the ACL permission works.
It's very granular, and it goes down to the user level.
And again, one more time
the reason it was built or it was introduced
into the Unix or Linux environment is
so we could assign permission to the user,
not to the every user, but to a specific user.
So, try it out and try it on different files,
try on different directories,
see how the directory works as well
how it could change the files
if you could log in CD into the directory
by giving specific access to a user.