Friday, June 22, 2012

NFSv4 ACL example 2

Grating user webservd permission to create files on a directory owned by bob. Note that according to the initial setup, webservd won't be able to do that unless additional permission is granted.

 But be aware!  
This will also allow webservd to delete all files on dir1! (and even dir1 itself!)

webservd@box-01:/home/bob/dir1 $ touch file1
touch: cannot create file1: Permission denied

bob@
box-01:~ $ chmod A0=user:webservd:rwxaRcs:allow dir1
bob@
box-01:~ $ ll -dV dir1
drwxr-xr-x+  2 bob      staff          2 Jun 20 09:01 dir1
          user:webservd:rwx---a-R-c--s:-------:allow
                 owner@:rwxp-DaARWcCos:-------:allow
                 group@:r-x---a-R-c--s:-------:allow
              everyone@:r-x---a-R-c--s:-------:allow

webservd@
box-01:/home/bob/dir1 $ touch file1
webservd@
box-01:/home/bob/dir1 $ ll
total 1
-rw-r--r--   1 webservd webservd       0 Jun 20 09:13 file1

webservd@
box-01:/home/bob/dir1 $ rm file2
rm: file2: override protection 640 (yes/no)? y


webservd@
box-01:/home/bob/dir1 $ ll
total 0