Use POSIX ACLs for file and directory access control in NAS - File Storage NAS

Configure POSIX access control lists (ACLs) to set fine-grained file and directory permissions in an NFSv3 file system.

Prerequisites

An NFSv3 file system is mounted. For more information, see Mount an NFS file system.
The NFS ACL feature has been enabled for the file system. If this feature is not enabled, you cannot use the setfacl command to set POSIX ACLs.
Log on to the NAS console, go to the file system details page, click the Access Control tab, and turn on the NFS ACL switch; or call the EnableNfsAcl operation.

Commands

The following table describes common POSIX ACL commands.

Command	Description
getfacl <filename>	Queries the ACL of a file.
setfacl -m g::w <filename>	Grants write permission to GROUP.
setfacl -m u:player:w <filename>	Grants write permission to user player.
setfacl -m g:players:rwx <filename>	Grants the read, write, and execute permissions to the players group.
setfacl -x g:players <filename>	Revokes permissions from the players group.
getfacl file1 \| setfacl --set-file=- file2	Copies the ACL of file1 to file2.
setfacl -b file1	Removes all extended ACEs from file1. Base ACEs for the owner, group, and others are retained.
setfacl -k file1	Removes all default ACEs from file1.
setfacl -R -m g:players:rw dir	Grants read and write permissions on all files and subdirectories in dir to the players group.
setfacl -d -m g:players:rw dir1	Grants default read and write permissions on new files and subdirectories in dir1 to the players group.

Configure POSIX ACLs

To configure POSIX ACLs for access control:

Create users and groups.
This example creates three users (player, admini, anonym) and two groups (players, adminis), then assigns player to the players group and admini to the adminis group.
```
sudo useradd player
sudo groupadd players
sudo usermod -g players player
sudo useradd admini
sudo groupadd adminis
sudo usermod -g adminis admini
sudo useradd anonym
```

Configure POSIX ACLs to control access to files and directories.

This example assumes that you create a directory named dir0. For all files in the dir0 directory, you grant read-only permissions to the players group, grant read, write, and execute permissions to the adminis group, and grant no permissions to other users.

sudo umask 777
sudo mkdir dir0
sudo setfacl -m g:players:r-x dir0
sudo setfacl -m g:adminis:rwx dir0
sudo setfacl -m u::--- dir0
sudo setfacl -m g::--x dir0
sudo setfacl -m o::--- dir0
sudo setfacl -d -m g:players:r-x dir0
sudo setfacl -d -m g:adminis:rwx dir0
sudo setfacl -d -m u::--- dir0
sudo setfacl -d -m g::--x dir0
sudo setfacl -d -m o::--- dir0

Run sudo getfacl dir0 to verify the configuration.

# file: dir0
# owner: root
# group: root
user::---
group::--x
group:players:r-x
group:adminis:rwx
mask::rwx
other::---
default:user::---
default:group::--x
default:group:players:r-x
default:group:adminis:rwx
default:mask::rwx
default:other::---

Verify the permissions.
1. Verify that the admini user has read and write permissions:
```
sudo su admini -c 'touch dir0/file'
```
```
sudo su admini -c 'echo 123 > dir0/file'
```
2. Verify that the player user has the read-only permissions.
  1. Verify that the player user cannot create the file file.
    For example, create a file file in the dir0 directory.
    - Run the following command:
      sudo su player -c 'touch dir0/file'
    - If a message similar to the following is returned, the player user does not have permissions to create the file file.
      touch: cannot touch ‘dir0/file’: Permission denied
  2. Verify that the player user can read dir0/file.
    - Run the following command:
      sudo su player -c 'cat dir0/file'
    - If the following information is returned, the player user has permissions to view the content of the dir0/file file.
      123
  3. Verify that the player user cannot write to the file.
    - Run the following command:
      sudo su player -c 'echo 456 >> dir0/file'
    - Expected output if write permission is denied:
      bash: dir0/file: Permission denied
    Run sudo su player -c 'getfacl dir0/file' to view the player user's permissions on dir0/file.
    # file: dir0/file # owner: admini # group: adminis user::--- group::--- group:players:r-x group:adminis:rwx mask::rwx other::---
3. Verify that the anonym user has no permissions on dir0.
  1. Verify that the anonym user cannot list files in dir0.
    - Run the following command:
      sudo su anonym -c 'ls dir0'
    - Expected output if permission is denied:
      ls: cannot open directory dir0: Permission denied
  2. Verify that the anonym user cannot read the file.
    - Run the following command:
      sudo su anonym -c 'cat dir0/file'
    - Expected output if read permission is denied:
      cat: dir0/file: Permission denied
  3. Verify that the anonym user cannot access the file's ACL.
    - Run the following command:
      sudo su anonym -c 'getfacl dir0/file'
    - Expected output if access is denied:
      getfacl: dir0/file: Permission denied

Revoke user permissions

The following example revokes a user's permissions by reassigning the user to a different group.

Best practice: grant permissions to groups, not individual users. To revoke access, move the user to a different group. The following steps move the admini user from the adminis group to adminis2.

Create the adminis2 group:
```
sudo groupadd adminis2
```
Move the admini user from the adminis group to adminis2:
```
sudo usermod -g adminis2 admini
```
Verify the user's group membership.
- Run the following command:
```
id admini
```
- The following information is returned:
```
uid=1057(admini) gid=1057(admini) groups=1061(adminis2)
```
Verify the permissions of the admini user.
1. Verify that the admini user cannot access dir0.
  - Run the following command:
```
sudo su admini -c 'ls dir0'
```
  - Expected output if the admini user cannot access dir0:
```
ls: cannot open directory dir0: Permission denied
```
2. Verify that the admini user cannot read dir0/file.
  - Run the following command:
```
sudo su admini -c 'cat dir0/file'
```
  - Expected output if the admini user cannot read dir0/file:
```
cat: dir0/file: Permission denied
```
3. Verify that the admini user cannot access dir0/file.
  - Run the following command:
```
sudo su admini -c 'getfacl dir0/file'
```
  - Expected output if the admini user cannot access dir0/file:
```
getfacl: dir0/file: Permission denied
```