课程第26次

admin

ACL组位上的实验：

1. [root@station60 labs]# useradd student
   
2. [root@station60 labs]# passwd student
   
3. Changing password for user student.
   
4. New password:
   
5. BAD PASSWORD: The password contains the user name in some form
   
6. Retype new password:
   
7. passwd: all authentication tokens updated successfully.
   
8. [root@station60 labs]# setfacl -m  u:student:rwx  1.txt.bak
   
9. [root@station60 labs]# getfacl 1.txt.bak
   
10. # file: 1.txt.bak
    
11. # owner: root
    
12. # group: root
    
13. user::rw-
    
14. user:student:rwx
    
15. group::r--
    
16. mask::rwx
    
17. other::r--
    
18. 
    
19. [root@station60 labs]# useradd visitor
    
20. [root@station60 labs]# passwd visitor
    
21. Changing password for user visitor.
    
22. New password:
    
23. BAD PASSWORD: The password contains the user name in some form
    
24. Retype new password:
    
25. Sorry, passwords do not match.
    
26. New password:
    
27. BAD PASSWORD: The password contains the user name in some form
    
28. Retype new password:
    
29. Sorry, passwords do not match.
    
30. New password:
    
31. BAD PASSWORD: The password contains the user name in some form
    
32. Retype new password:
    
33. passwd: all authentication tokens updated successfully.
    
34. [root@station60 labs]# setfacl -m  u:visitor:---  1.txt.bak
    
35. [root@station60 labs]# getfacl 1.txt.bak
    
36. # file: 1.txt.bak
    
37. # owner: root
    
38. # group: root
    
39. user::rw-
    
40. user:student:rwx
    
41. user:visitor:---
    
42. group::r--
    
43. mask::rwx
    
44. other::r--
    
45. 
    
46. [root@station60 labs]# ls -l
    
47. total 4
    
48. -rw-rwxr--+ 1 root root 18 Jun  6 08:15 1.txt.bak
    
49. [root@station60 labs]# getfacl 1.txt.bak
    
50. # file: 1.txt.bak
    
51. # owner: root
    
52. # group: root
    
53. user::rw-
    
54. user:student:rwx
    
55. user:visitor:---
    
56. group::r--
    
57. mask::rwx
    
58. other::r--
    
59. 
    
60. [root@station60 labs]# umask
    
61. 0022
    
62. [root@station60 labs]# ls -l
    
63. total 4
    
64. -rw-rwxr--+ 1 root root 18 Jun  6 08:15 1.txt.bak
    
65. [root@station60 labs]# ls
    
66. 1.txt.bak
    
67. [root@station60 labs]# vim 1.txt.bak
    
68. [root@station60 labs]# su - visitor
    
69. [visitor@station60 ~]$ cd /root/labs
    
70. -bash: cd: /root/labs: Permission denied
    
71. [visitor@station60 ~]$ exit
    
72. logout
    
73. [root@station60 labs]# cd ..
    
74. [root@station60 ~]# mv labs/ /
    
75. mv: overwrite ‘/labs’? ^C
    
76. [root@station60 ~]# rm -rf /labs
    
77. [root@station60 ~]# mv labs/  /
    
78. [root@station60 ~]# su - visitor
    
79. Last login: Tue Jun 11 08:10:48 EDT 2019 on pts/0
    
80. [visitor@station60 ~]$ cd /labs
    
81. [visitor@station60 labs]$ ls
    
82. 1.txt.bak
    
83. [visitor@station60 labs]$ cat 1.txt.bak
    
84. cat: 1.txt.bak: Permission denied
    
85. [visitor@station60 labs]$ exit
    
86. logout
    
87. [root@station60 ~]# su  - student
    
88. [student@station60 ~]$ cd /labs/
    
89. [student@station60 labs]$ cat 1.txt.bak
    
90. cow
    
91. cow cow
    
92. fish
    
93. [student@station60 labs]$ echo "XXXX" >> 1.txt.bak
    
94. [student@station60 labs]$ ls
    
95. 1.txt.bak
    
96. [student@station60 labs]$ getfacl   1.txt.bak
    
97. # file: 1.txt.bak
    
98. # owner: root
    
99. # group: root
    
100. user::rw-
     
101. user:student:rwx
     
102. user:visitor:---
     
103. group::r--
     
104. mask::rwx
     
105. other::r--
     
106. 
     
107. [student@station60 labs]$ ls -l
     
108. total 4
     
109. -rw-rwxr--+ 1 root root 23 Jun 11 08:11 1.txt.bak
     
110. [student@station60 labs]$ chmod g=rw 1.txt.bak
     
111. chmod: changing permissions of ‘1.txt.bak’: Operation not permitted
     
112. [student@station60 labs]$ eixt
     
113. bash: eixt: command not found...
     
114. [student@station60 labs]$ exit
     
115. logout
     
116. [root@station60 ~]# cd /labs
     
117. [root@station60 labs]# ls
     
118. 1.txt.bak
     
119. [root@station60 labs]# chmod g=rw 1.txt.bak
     
120. [root@station60 labs]# ls -l
     
121. total 4
     
122. -rw-rw-r--+ 1 root root 23 Jun 11 08:11 1.txt.bak
     
123. [root@station60 labs]# getfacl  1.txt.bak
     
124. # file: 1.txt.bak
     
125. # owner: root
     
126. # group: root
     
127. user::rw-
     
128. user:student:rwx                #effective:rw-
     
129. user:visitor:---
     
130. group::r--
     
131. mask::rw-
     
132. other::r--
     
133. 
     
134. [root@station60 labs]# ls
     
135. 1.txt.bak
     
136. [root@station60 labs]# mv 1.txt.bak  1.sh
     
137. [root@station60 labs]# ls
     
138. 1.sh
     
139. [root@station60 labs]# vim 1.sh
     
140. [root@station60 labs]# ls
     
141. 1.sh
     
142. [root@station60 labs]# ./1.sh
     
143. -bash: ./1.sh: Permission denied
     
144. [root@station60 labs]# chmod u+x 1.sh
     
145. [root@station60 labs]# getfa
     
146. getfacl   getfattr
     
147. [root@station60 labs]# getfacl  1.sh
     
148. # file: 1.sh
     
149. # owner: root
     
150. # group: root
     
151. user::rwx
     
152. user:student:rwx                #effective:rw-
     
153. user:visitor:---
     
154. group::r--
     
155. mask::rw-
     
156. other::r--
     
157. 
     
158. [root@station60 labs]# ./1.sh
     
159. Hello World
     
160. [root@station60 labs]# su - student
     
161. Last login: Tue Jun 11 08:11:32 EDT 2019 on pts/0
     
162. [student@station60 ~]$ cd /labs
     
163. [student@station60 labs]$ ls
     
164. 1.sh
     
165. [student@station60 labs]$ ./1.sh
     
166. -bash: ./1.sh: Permission denied
     
167. [student@station60 labs]$
     

复制代码

另外一种改掩码的方法：

1. [root@station60 sub1]# getfacl 3.txt
   
2. # file: 3.txt
   
3. # owner: root
   
4. # group: root
   
5. user::rw-
   
6. group::r-x
   
7. other::r--
   
8. 
   
9. [root@station60 sub1]# ls -l
   
10. total 0
    
11. -rw-r-xr--. 1 root root 0 Jun 11 09:10 3.txt
    
12. [root@station60 sub1]# setfacl -m m::r 3.txt
    
13. [root@station60 sub1]# ls -l
    
14. total 0
    
15. -rw-r--r--+ 1 root root 0 Jun 11 09:10 3.txt
    
16. [root@station60 sub1]# getfacl 3.txt
    
17. # file: 3.txt
    
18. # owner: root
    
19. # group: root
    
20. user::rw-
    
21. group::r-x                      #effective:r--
    
22. mask::r--
    
23. other::r--
    
24. 
    
25. [root@station60 sub1]#
    

复制代码

如果真要改group选项：

1. [root@station60 labs]# ls
   
2. 1.sh
   
3. [root@station60 labs]# getfacl  1.sh
   
4. # file: 1.sh
   
5. # owner: root
   
6. # group: root
   
7. user::rwx
   
8. user:student:rwx                #effective:rw-
   
9. user:visitor:---
   
10. group::r--
    
11. mask::rw-
    
12. other::r--
    
13. 
    
14. [root@station60 labs]# setfacl  -m u::rw
    
15. Usage: setfacl [-bkndRLP] { -m|-M|-x|-X ... } file ...
    
16. Try `setfacl --help' for more information.
    
17. [root@station60 labs]# setfacl  -m u::rw 1.sh
    
18. [root@station60 labs]# getfacl  1.sh
    
19. # file: 1.sh
    
20. # owner: root
    
21. # group: root
    
22. user::rw-
    
23. user:student:rwx
    
24. user:visitor:---
    
25. group::r--
    
26. mask::rwx
    
27. other::r--
    
28. 
    
29. [root@station60 labs]#
    

复制代码

默认acl权限和默认掩码：

1. [root@station60 labs]# ls -ld
   
2. drwxr-xr-x+ 3 root root 42 Jun 11 09:10 .
   
3. [root@station60 labs]# setfacl  -b .
   
4. [root@station60 labs]# ls -ld
   
5. drwxr-xr-x. 3 root root 42 Jun 11 09:10 .
   
6. [root@station60 labs]# ls -ldf
   
7. .
   
8. [root@station60 labs]# ls -ld
   
9. drwxr-xr-x. 3 root root 42 Jun 11 09:10 .
   
10. [root@station60 labs]# setfacl -m d:u:student:rX  .
    
11. [root@station60 labs]# getfacl ./
    
12. # file: .
    
13. # owner: root
    
14. # group: root
    
15. user::rwx
    
16. group::r-x
    
17. other::r-x
    
18. default:user::rwx
    
19. default:user:student:r-x
    
20. default:group::r-x
    
21. default:mask::r-x
    
22. default:other::r-x
    
23. 
    
24. [root@station60 labs]# setfacl -m d:u:student:rwX  .
    
25. [root@station60 labs]# getfacl ./
    
26. # file: .
    
27. # owner: root
    
28. # group: root
    
29. user::rwx
    
30. group::r-x
    
31. other::r-x
    
32. default:user::rwx
    
33. default:user:student:rwx
    
34. default:group::r-x
    
35. default:mask::rwx
    
36. default:other::r-x
    
37. 
    
38. [root@station60 labs]# setfacl -m d:m::rX  .
    
39. [root@station60 labs]# getfacl ./
    
40. # file: .
    
41. # owner: root
    
42. # group: root
    
43. user::rwx
    
44. group::r-x
    
45. other::r-x
    
46. default:user::rwx
    
47. default:user:student:rwx        #effective:r-x
    
48. default:group::r-x
    
49. default:mask::r-x
    
50. default:other::r-x
    
51. 
    
52. [root@station60 labs]# mkdir sub2
    
53. [root@station60 labs]# setfacl sub1
    
54. Usage: setfacl [-bkndRLP] { -m|-M|-x|-X ... } file ...
    
55. Try `setfacl --help' for more information.
    
56. [root@station60 labs]# getfacl sub1
    
57. # file: sub1
    
58. # owner: root
    
59. # group: root
    
60. user::rwx
    
61. group::r-x
    
62. other::r--
    
63. 
    
64. [root@station60 labs]# getfacl sub2
    
65. # file: sub2
    
66. # owner: root
    
67. # group: root
    
68. user::rwx
    
69. user:student:rwx                #effective:r-x
    
70. group::r-x
    
71. mask::r-x
    
72. other::r-x
    
73. default:user::rwx
    
74. default:user:student:rwx        #effective:r-x
    
75. default:group::r-x
    
76. default:mask::r-x
    
77. default:other::r-x
    
78. 
    
79. [root@station60 labs]# su - student
    
80. Last login: Tue Jun 11 08:47:37 EDT 2019 on pts/0
    
81. [student@station60 ~]$ cd /labs
    

复制代码