Hello, and a big warm welcome to this module from Pluralsight.
My name is Andrew Mallett,
and I'm going to be your instructor as I guide you through the module,
Extending the File Mode with Access Control Lists.
Now as we work our way through this module,
we're going to be taking a look at the limitations of our file mode.
So our file mode, or our standard Linux permissions,
are okay, they do work to a degree,
but our big limitation is that we are limited to a single
user and a single group; otherwise,
we then have to pick up permissions granted through to others.
We can mitigate these limitations by using POSIX ACLs.
We're just prefacing our ACLs here with POSIX,
and there are different types of access control lists that we can use.
We've got sys shares for when we're sharing out towards our Windows users,
and these take sys ACLs.
In the same way, on an NFS version 4 server,
we have access control lists to control the access via the NFS server,
and these would be then our NFS v4 access control lists.
We're specifically looking at the POSIX ACLs in this module.
We need to take a look at understanding how we can work out whether or
not our Linux system supports access control lists.
Now if it's a modern Linux distribution,
chances are it is going to support access control lists,
so I wouldn't be too concerned about it.
But if it is an older system that you've just inherited,
then we might have to do some checks first.
Once we know we support our access control lists,
we're going to take a look at how we can both view the access control
list because it won't show within our standard mode and also looking
at how we set the access control list.
We'll be taking a look at something really,
really useful,
you're going to love this, the default ACL. With a default ACL,
we can assign that to a directory, and then all new files created
within the directory are going to pick up the ACL that we've
configured as the default.
We can look at other ways we can add access controllers to our files.
We'll look at how we can remove the complete access
control list or a specific ACL entry.
So this is what we're going to be looking at as we work our way through.
Hopefully, it's what you were expecting.
But what does it all mean? Well, when we look at the security,
maybe we can blow all our security away when we look at our file mode.
The UNIX file mode where our standard permissions have been inherited from
was never really designed for enterprise file sharing.
It's just grown into a little bit of a monster.
It allows as, we've talked about, a single user,
a single group, and then everyone else is going to be
picked up through the assignment of others.
So maybe too many things need to be assigned to others to make it work.
There are ways that we can work around this.
We can just keep on creating more and more groups,
but we can't nest groups into one another, so it's difficult
to manage. But we're then trying to create groups just to
match the needs of our file system.
And in fact,
you will find there are a limitation to the number of groups
that can be assigned through to a user. Even though we might
belong, let's say, to many groups,
we might find that we're not reading all of our group membership, so
we start seeing other problems coming into play.
And even so, even if all of this is working for us,
it doesn't cater for the scenarios where we need a user or a group
to have one level of access and another user or group to have a
completely different level of access.
Ultimately,
we do have to be able to list more than one user or more than
one group within our access control list.
It's our access control list that we're going to be taking a
look now that overcome these limitations.
Now we have been talking about POSIX ACLs,
so these are ACLs that are associated with our standard file
systems, and they allow then more than one user or more than one
group or multiple users and multiple groups to be listed with
permissions to a file resource.
They don't have to have the same permissions,
but we can make sure then that maybe group one has read
permissions, group two has read and write permissions.
As we said though,
some really cool feature that we're going to be able to
make use of is the default permissions.
We can set a default permission on the directory, and then all new files
created in that directory are going to gain those permissions that are
coming from the default set on the parent.
So this is going to be stuff that we can really use and use
practically well in our scenarios, and we'll look at some good
practical demonstrations as well.
It's probably not an issue on modern‑day Linux distributions.
We're working with our AlmaLinux 8. We're working with our openSUSE
system. We're working with Ubuntu. All of these are recent distributions.
But we can check that we've got the the ACL package installed. Obviously,
using the correct package manager. So YUM we can use on our Red Hat‑based
systems, we'll be using Zypper on openSUSE, and we will be using the
package manager APT, or Advanced Packaging Tool, on our Ubuntu‑based
system.
We can also go through and check our configuration
file of what's built into our kernel.
We can extract dynamically the kernel version,
the release, by using uname ‑r, and that's going to be appended to
the end of the /boot/config file. We can check in there for our ACL
support. Here, grep ‑i is just doing a case insensitive search.
Sticking with the idea of working on Red Hat‑based systems, we can go
through and use the Red Hat Package Manager, RPM, specific to this
operating system,
but we can then go through in query a file, and we can look at the
getfacl command. Which getfacl will return its full path, so we're
able then to query which package does this belong to. No surprises.
It's going to be the acl package.
Our file system also needs to be able to support access
control lists. It's not just our kernel. Again,
modern distributions and modern file systems should support it,
but we can go through and check using the tune2fs command to
check an ext4 file system to see if it supports ACLs. But if it
is an XFS file system that we're using, it has ACL support by default,
so there's definitely no need to check that.
But again, on modern distributions, you're going to find that ACL
support is definitely built in. But moving to something just a little
bit older where we're getting maybe five, six, seven years ago, then
maybe the situation is a little bit more variable where we need to check
a little bit more. But do you know what? We're not going to learn by
looking at these slides,
we're going to learn by getting our hands dirty, so let's
move out to our command line for our first demonstration as we gather some of this information.