Friday, June 22, 2012

NFSv4 ACL example 7

Granting webservd modify access on the contents of new subdirectories created by bob.
This could be viewed as a variation of example 1 but the action of creation depends on bob.
No other action will be necessary to prevent webservd from deleting the new subdirectories.

bob@box-01:~/dir1 $ mkdir subdir2
bob@
box-01:~/dir1 $ ll -dV subdir2 
drwxr-xr-x   2 bob      staff      2 Jun 21 13:29 subdir2
                 owner@:rwxp-DaARWcCos:-------:allow
                 group@:r-x---a-R-c--s:-------:allow
              everyone@:r-x---a-R-c--s:-------:allow

bob@
box-01:~/dir1 $ chmod A+user:webservd:w:di:allow subdir2
bob@
box-01:~/dir1 $ ll -dV subdir2 
drwxr-xr-x+  2 bob      staff      2 Jun 21 13:29 subdir2
          user:webservd:-w------------:-di----:allow
                 owner@:rwxp-DaARWcCos:-------:allow
                 group@:r-x---a-R-c--s:-------:allow
              everyone@:r-x---a-R-c--s:-------:allow

webservd@
box-01:/home/bob/dir1 $ ll
total 3
drwxr-xr-x+  2 bob      staff      2 Jun 21 13:29 subdir2

webservd@
box-01:/home/bob/dir1 $ echo Hello > subdir2/file21
bash: subdir2/file21: Permission denied

webservd@
box-01:/home/bob/dir1 $ mkdir subdir3
mkdir: Failed to make directory "subdir3"; Permission denied

bob@
box-01:~/dir1 $ mkdir subdir2/folder1
bob@
box-01:~/dir1 $ ll -dV subdir2/folder1/
drwxr-xr-x+  2 bob      staff      2 Jun 21 13:37 subdir2/folder1/
          user:webservd:-w------------:-d----I:allow
                 owner@:rwxp-DaARWcCos:-------:allow
                 group@:r-x---a-R-c--s:-------:allow
              everyone@:r-x---a-R-c--s:-------:allow

webservd@
box-01:/home/bob/dir1 $ echo Hi > subdir2/folder1/file211 
webservd@box-01:/home/bob/dir1 $ echo Yup > subdir2/folder1/file212
webservd@box-01:/home/bob/dir1 $ ll subdir2/folder1/
total 3
-rw-r--r--   1 webservd webservd   3 Jun 21 13:40 file211
-rw-r--r--   1 webservd webservd   4 Jun 21 13:40 file212

webservd@
box-01:/home/bob/dir1 $ rm -r subdir2/folder1
rm: Unable to remove directory subdir2/folder1: Permission denied

webservd@
box-01:/home/bob/dir1 $ ll subdir2/folder1/
total 0

webservd@
box-01:/home/bob/dir1 $ rm -fr subdir2
rm: Unable to remove directory subdir2/folder1: Permission denied
rm: Unable to remove directory subdir2: Permission denied