Use POSIX ACLs for file and directory access control in NAS - File Storage NAS

Prerequisites

An NFSv3 file system is mounted. For more information, see Mount an NFS file system.

Commands

The following table describes common POSIX ACL commands.

Command	Description
getfacl <filename>	Queries the ACL of a file.
setfacl -m g::w <filename>	Grants the write permission (`w`) to the file's owning group.
setfacl -m u:player:w <filename>	Grants write permission to user player.
setfacl -m g:players:rwx <filename>	Grants the read, write, and execute permissions to the players group.
setfacl -x g:players <filename>	Revokes permissions from the players group.
getfacl file1 \| setfacl --set-file=- file2	Copies the ACL of file1 to file2.
setfacl -b file1	Removes all extended ACEs from file1. Base ACEs for the owner, group, and others are retained.
setfacl -k file1	Removes all default ACEs from file1.
setfacl -R -m g:players:rw dir	Grants read and write permissions on all files and subdirectories in dir to the players group.
setfacl -d -m g:players:rw dir1	Grants default read and write permissions on new files and subdirectories in dir1 to the players group.

Configure POSIX ACLs

To configure POSIX ACLs for access control:

Create users and groups.
This example creates three users (player, admini, anonym) and two groups (players, adminis), then assigns player to the players group and admini to the adminis group.
```
sudo useradd player
sudo groupadd players
sudo usermod -g players player
sudo useradd admini
sudo groupadd adminis
sudo usermod -g adminis admini
sudo useradd anonym
```

Configure POSIX ACLs to control access to files and directories.

The following commands create a dir0 directory and set its ACLs:

The players group gets read and execute permissions (r-x).
The adminis group gets read, write, and execute permissions (rwx).
The owning user and "others" have no permissions (---).

sudo umask 777
sudo mkdir dir0
sudo setfacl -m g:players:r-x dir0
sudo setfacl -m g:adminis:rwx dir0
sudo setfacl -m u::--- dir0
sudo setfacl -m g::--x dir0
sudo setfacl -m o::--- dir0
sudo setfacl -d -m g:players:r-x dir0
sudo setfacl -d -m g:adminis:rwx dir0
sudo setfacl -d -m u::--- dir0
sudo setfacl -d -m g::--x dir0
sudo setfacl -d -m o::--- dir0

Run sudo getfacl dir0 to verify the configuration.

# file: dir0
# owner: root
# group: root
user::---
group::--x
group:players:r-x
group:adminis:rwx
mask::rwx
other::---
default:user::---
default:group::--x
default:group:players:r-x
default:group:adminis:rwx
default:mask::rwx
default:other::---

Verify the permissions.
1. Verify that the admini user has read and write permissions:
```
sudo su admini -c 'touch dir0/file'
```
```
sudo su admini -c 'echo 123 > dir0/file'
```
2. Verify that the player user has the read-only permissions.
  1. Verify that the player user cannot create the file file.
    
    Attempt to create a file named file in dir0 as the player user.
    - Run the following command:
      sudo su player -c 'touch dir0/file'
    - Expected output if permission is denied:
      touch: cannot touch 'dir0/file': Permission denied
  2. Verify that the player user can read dir0/file.
    - Run the following command:
      sudo su player -c 'cat dir0/file'
    - Expected output if read permission is granted:
      123
  3. Verify that the player user cannot write to the file.
    - Run the following command:
      sudo su player -c 'echo 456 >> dir0/file'
    - Expected output if write permission is denied:
      bash: dir0/file: Permission denied
    Run sudo su player -c 'getfacl dir0/file' to view the player user's permissions on dir0/file.
    # file: dir0/file # owner: admini # group: adminis user::--- group::--- group:players:r-x group:adminis:rwx mask::rwx other::---
3. Verify that the anonym user has no permissions on dir0.
  1. Verify that the anonym user cannot list files in dir0.
    - Run the following command:
      sudo su anonym -c 'ls dir0'
    - Expected output if permission is denied:
      ls: cannot open directory dir0: Permission denied
  2. Verify that the anonym user cannot read the file.
    - Run the following command:
      sudo su anonym -c 'cat dir0/file'
    - Expected output if read permission is denied:
      cat: dir0/file: Permission denied
  3. Verify that the anonym user cannot access the file's ACL.
    - Run the following command:
      sudo su anonym -c 'getfacl dir0/file'
    - Expected output if access is denied:
      getfacl: dir0/file: Permission denied

Revoke user permissions

The following example revokes a user's permissions by reassigning the user to a different group.

Best practice: grant permissions to groups, not individual users. To revoke access, move the user to a different group. The following steps move the admini user from the adminis group to adminis2.

Create the adminis2 group:
```
sudo groupadd adminis2
```
Move the admini user from the adminis group to adminis2:
```
sudo usermod -g adminis2 admini
```
Verify the user's group membership.
- Run the following command:
```
id admini
```
- The following information is returned:
```
uid=1057(admini) gid=1057(admini) groups=1061(adminis2)
```
Verify the permissions of the admini user.
1. Verify that the admini user cannot access dir0.
  - Run the following command:
```
sudo su admini -c 'ls dir0'
```
  - Expected output if the admini user cannot access dir0:
```
ls: cannot open directory dir0: Permission denied
```
2. Verify that the admini user cannot read dir0/file.
  - Run the following command:
```
sudo su admini -c 'cat dir0/file'
```
  - Expected output if the admini user cannot read dir0/file:
```
cat: dir0/file: Permission denied
```
3. Verify that the admini user cannot access dir0/file.
  - Run the following command:
```
sudo su admini -c 'getfacl dir0/file'
```
  - Expected output if the admini user cannot access dir0/file:
```
getfacl: dir0/file: Permission denied
```