markdown Linux权限通过setfacl进行访问控制列表配置

Posted 2021-05-06

# Modify Linux Directory Permission via setfacl

``` bash
$ ls -ld /var/www
drwxr-xr-x 2 apache www 4096 Aug  7 13:53 /var/www

$ sudo setfacl -dRm u:apache:rwX,g:www:rwX /var/www

$ ls -ld /var/www
drwxr-xr-x+ 2 apache www 4096 Aug  7 13:53 /var/www

$ getfacl /var/www
# file: var/www
# owner: apache
# group: www
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:apache:rwx
default:group::r-x
default:group:www:rwx
default:mask::rwx
default:other::r-x

$ touch donkey
$ ls -l donkey
-rw-rw-r--+ 1 gene gene 0 Aug  7 13:57 donkey

$ getfacl donkey
# file: donkey
# owner: gene
# group: gene
user::rw-
user:apache:rwx               #effective:rw-
group::rwx                      #effective:rw-
group:www:rwx              #effective:rw-
mask::rw-
other::r--
```
Command overview
```bash
setfacl -dRm u:apache:rwX,g:www:rwX /var/www
```

- The `-d` flag specifies the operations apply to the Default ACL.
- The `-R` flag sets operations to apply recursively
- The `-m` indicates it will be a modification operation

Then after that it's pretty straight forward

- `u:USERNAME:permissions`
- `g:GROUPNAME:permissions`