Administrace komentářů

caues

potrebuju obligatne nastavit jeden adresar (v linuxu) kde budou mit vsichni full access i k souborum a slozkam co vytvoril nekdo jinej .. nejsem schopen to v linuxu udelat:

# ls -ld foo/
drwxr-xr-x 2 root root 4096 2011-03-21 19:29 foo/
# setfacl --set=group:users:rwx foo
setfacl: foo: Malformed access ACL `group:users:rwx,mask::rwx': Missing or wrong entry at entry 1

co tomu tady chybi mi neni jasne .. rekl bych ze tam je nejakej problem s dedicnost potom, stravil jsem s tim vic pokusu. Zde uvadim priklad na solarisu kde to funguje fajn a dedicnost tam resi v zfs aclmode=passthrough a aclinherit=passthrough ..

# zfs create -o mountpoint=/share/devel -o aclmode=passthrough -o aclinherit=passthrough rpool/share/devel

# chmod A+group:other:rwxp:fd:allow /share/devel/

# id dpecka; id jdoe
uid=100(dpecka) gid=1(other)
uid=101(jdoe) gid=1(other)

# ls -dV .
drwxr-xr-x+  2 root     root           2 Mar 21 18:00 .
       group:other:rwxp----------:fd----:allow
            owner@:--------------:------:deny
            owner@:rwxp---A-W-Co-:------:allow
            group@:-w-p----------:------:deny
            group@:r-x-----------:------:allow
         everyone@:-w-p---A-W-Co-:------:deny
         everyone@:r-x---a-R-c--s:------:allow

# su dpecka
typo3:/share/devel> mkdir -p a/b/c
typo3:/share/devel> gfind a/ -exec ls -dV {} \; exit
drwxr-xr-x+  3 dpecka   other          3 Mar 21 18:15 a/
       group:other:rwxp----------:fdi---:allow
       group:other:rwxp----------:------:allow
            owner@:--------------:------:deny
            owner@:rwxp---A-W-Co-:------:allow
            group@:-w-p----------:------:deny
            group@:r-x-----------:------:allow
         everyone@:-w-p---A-W-Co-:------:deny
         everyone@:r-x---a-R-c--s:------:allow
drwxr-xr-x+  3 dpecka   other          3 Mar 21 18:15 a/b
       group:other:rwxp----------:fdi---:allow
       group:other:rwxp----------:------:allow
            owner@:--------------:------:deny
            owner@:rwxp---A-W-Co-:------:allow
            group@:-w-p----------:------:deny
            group@:r-x-----------:------:allow
         everyone@:-w-p---A-W-Co-:------:deny
         everyone@:r-x---a-R-c--s:------:allow
drwxr-xr-x+  2 dpecka   other          2 Mar 21 18:15 a/b/c
       group:other:rwxp----------:fdi---:allow
       group:other:rwxp----------:------:allow
            owner@:--------------:------:deny
            owner@:rwxp---A-W-Co-:------:allow
            group@:-w-p----------:------:deny
            group@:r-x-----------:------:allow
         everyone@:-w-p---A-W-Co-:------:deny
         everyone@:r-x---a-R-c--s:------:allow

# su jdoe
typo3:/share/devel> touch a/b/file; rmdir a/b/c/
typo3:/share/devel> gfind a/ -exec ls -dV {} \;
drwxr-xr-x+  3 dpecka   other          3 Mar 21 18:15 a/
       group:other:rwxp----------:fdi---:allow
       group:other:rwxp----------:------:allow
            owner@:--------------:------:deny
            owner@:rwxp---A-W-Co-:------:allow
            group@:-w-p----------:------:deny
            group@:r-x-----------:------:allow
         everyone@:-w-p---A-W-Co-:------:deny
         everyone@:r-x---a-R-c--s:------:allow
drwxr-xr-x+  2 dpecka   other          3 Mar 21 18:17 a/b
       group:other:rwxp----------:fdi---:allow
       group:other:rwxp----------:------:allow
            owner@:--------------:------:deny
            owner@:rwxp---A-W-Co-:------:allow
            group@:-w-p----------:------:deny
            group@:r-x-----------:------:allow
         everyone@:-w-p---A-W-Co-:------:deny
         everyone@:r-x---a-R-c--s:------:allow
-rw-r--r--+  1 jdoe     other          0 Mar 21 18:17 a/b/file
       group:other:rwxp----------:------:allow
            owner@:--x-----------:------:deny
            owner@:rw-p---A-W-Co-:------:allow
            group@:-wxp----------:------:deny
            group@:r-------------:------:allow
         everyone@:-wxp---A-W-Co-:------:deny
         everyone@:r-----a-R-c--s:------:allow

typo3:/share/devel> rmg -rv a/
removed `a//b/file'
removed directory: `a//b'
removed directory: `a/'

typo3:/share/devel> id
uid=101(jdoe) gid=1(other)

prosim ukazte mi priklad kdy vytvorime nejakou slozku s default umaskou 755 a pomoci ACLs ji nastavime aby to fungovalo pro uzivatele ze skupiny *users tak jako v prikladu vyse pro uzivatele skupiny *others ..
to setfacl me fakt muci ..

zatim to resim skutecne opovrzenihodnym mountem nfs pres localhost:

# grep localh /etc/exports
/srv/nfs        localhost(rw,anonuid=1001,anongid=100,all_squash,no_subtree_check)

zdravim a dekuju