Now something we can do straight off the bat without having to concentrate
too much on our ACLs is something called a default ACL,
and we're going to look at a practical way that we can show this in use.
We're going to make sure that we've got HTTPD installed.
Probably you might already have it installed if you
followed through on the last exercise.
We will have it on our system, so I'm going to remove
it and clear out my document root.
So we're going to be starting again from fresh. If we go through and
straightaway set our file system ACL, so setfacl.
If we set our ACL, and don't worry too much about the ACL that we're
setting, if I set that on the directory /var/www/html, all new files
created in there it's going to allow the Apache user read access to that
file and others will have no access.
So I don't need to be concerned about what my current umask value is.
All I need to do is just do one operation on the HTML directory.
If we then go through and create a web page, very simple, I
don't think you'll like it very much,
but it's a web page nonetheless. When we go through and take a look,
we're going to be able to see something different about our permissions.
We won't be able to see the ACL.
We have to go through and read that with getfacl. But don't worry,
we're going to do that in the demonstration.
But let's spend a little bit more time just looking at what we've actually done.
So with the setfacl command, we are modifying the
access control list; ‑m means modify.
When we look at the essential aspects of the command, we've got the command,
any rules, and any files that we want to apply. More than one rule can
exist. If they do, then they're comma‑separated.
When we look at our first rule, d is for a default access control.
So it's not actually applying to the directory that we apply it
to, only to new content. U is adding in a user, that user is
Apache, and we're giving read permissions.
When we look at our second rule, again,
it was a default, we're assigning them to others, so we don't specify a
name for others, it's obviously unnamed, and we're assigning no
permissions, so we just put a dash in so we can understand it's no
permissions that are being assigned. And that's it.
That's all that we need to do.
And again,
we've kind of set the system to work for us and we kind of have
this policy now that says any new file is going to have Apache with
read permissions and others with none.
We need to see how this gorgeous piece of equipment works.
Let's find ourselves a command line.
So yes,
we're going to dive straight out to our command line and keep this very
practical so we can get some benefits from our access control list straightaway,
and we don't kind of have to imagine how could we use it.
We're going to show you how you can use this.
So the first thing that I'm going to do,
just make sure that I don't have the web server installed,
we're going to install it again from fresh.
So we can go through and run our sudo and yum remove and then httpd. We
can go ahead and accept all of this. Now that's there, but because
we've added content into our HTML directory,
that's likely still to be there, so we can do a sudo and rm, and then ‑rf
/var/www, and then html. So we had previously shown that using special
permissions and making sure that our umask was set correctly,
we were able to go through and configure our permissions so they
work for us. We're going to see now with a single command how we
can do it. If I look at the umask at the moment, we've got a
umask that's set to 2.
So we're only removing write from others.
We had had the umask before of 27, so we were removing all permissions
from others and write from the group. But we're going to go straight
ahead now and install, so we can do a yum install ‑y, then http. We can
allow that to run through, and that's, of course, then going to put our
directory back in place.
We're going to go through now and use sudo and setfacl.
We're going to modify the ACL.
We're setting the default, so we're not applying to the
directory that I'm going to assign to.
We want to set it for a user, and that user is the Apache user. We could
always check from the past wd file what the user account is, and we want
to assign them read permissions. But that's not all. We want to continue
working with the defaults, so we just put comma and d. We want to assign
now we've got user group or others, we want to assign to others. There's
no user we specify for others, but we then just set the permissions to be
empty. And we're doing this then for our /var/www/html directory.
Now when I go through and do an ls ‑l on this, we're
going to see it shows slightly different.
Let's do an ld. It might show me a little bit better.
We can see that there is a plus at the end. And that shows me that
we've extended our mode into an access control list.
If we want to read that, we can then use getfacl.
Now when we take a look at this, we can see there is not an ACL as
such, only the default. The default is going to affect our new
files, but it's then applying the user Apache to have read, and
others will have no permissions.
So if we then go, so I'm just going to do a very simple way with sudo
and vim, and then look at the index.html, put in our glorious web
page. Once we've got our web page created,
we can go through and save it. And now when I go through and take a look,
let's do a getfacl, it's not going to show very much with that ls, so
getfacl, and then go through and look at our index.html.
We can see then that others have no permissions. The Apache user has read.
So our system now is up and running and up and running by
design and now becomes the default behavior.
Any files added to the directory will have the correct
permissions irrespective of our current umask.
We can also use, if we want to, the ls ‑l.
Others will show in that.
So as I go through then and bring up that file again,
we can see no permissions are listed for others because we've
removed the permissions through the default ACL. How amazing is that?