Friday, June 22, 2012

NFSv4 ACL example 4

Granting webservd permission to just write to (not read from) a single file (mode 640) on a directory owned by bob. Note that according to the initial setup, by "other" permission bit, webservd wouldn't be able to write to any file at all.

bob@box-01:~/dir1 $ printf "Hello" > file2
bob@
box-01:~/dir1 $ chmod 640 file2
bob@box-01:~/dir1 $ ll -dV file2
-rw-r-----   1 bob      staff          5 Jun 20 10:12 file2
                 owner@:rw-p--aARWcCos:-------:allow
                 group@:r-----a-R-c--s:-------:allow
              everyone@:------a-R-c--s:-------:allow

bob@
box-01:~/dir1 $ chmod A+user:webservd:waRcs:allow file2
bob@
box-01:~/dir1 $ ll -dV file2
-rw-r-----+  1 bob      staff          5 Jun 20 10:12 file2
          user:webservd:-w----a-R-c--s:-------:allow
                 owner@:rw-p--aARWcCos:-------:allow
                 group@:r-----a-R-c--s:-------:allow
              everyone@:------a-R-c--s:-------:allow

webservd@
box-01:/home/bob/dir1 $ cat file2
cat: cannot open file2: Permission denied

webservd@
box-01:/home/bob/dir1 $ echo ', world!' >> file2
webservd@
box-01:/home/bob/dir1 $ ll file2
-rw-r-----+  1 bob      staff         14 Jun 20 10:15 file2

bob@
box-01:~/dir1 $ cat file2
Hello, world!

webservd@
box-01:/home/bob/dir1 $ rm file2
rm: file2 not removed: Permission denied