Now as we've already seen that we can go through and set up the
default ACL on our directory to affect all new content,
but we can also go through and set the ACL on a directory.
Let's say we wanted to create a private directory that should be
shared between specific users or specific groups.
We can initially go through and create that with a mode of
700, so it's completely private. If we want,
let's say my Vagrant user account to have access,
we can go through and give it the appropriate access. Here, we're
adding in the user to the ACL of the private directory,
giving them read, write, and execute.
We can also ensure that they have access to files in the
directory, and we can give the read,
write, and execute to files created within the directory.
Now this would then be files in general.
Still on a regular file,
we wouldn't have execute, but on a directory, we would have execute. And we can
do this by setting the default ACL, so just having the d in front of the user.
We can go through and look at the output of ls ‑l.
The plus will indicate there is an access control list in place.
Getfacl will return the complete ACL. And if we only want to use
the default ACL when looking at a directory,
we can use getfacl and ‑d. As we go through,
we can add and remove entries, so setfacl modify.
We can then go through and maybe add in a user tux or a user that you have on
your system and giving them then read and execute through.
If that was erroneous, we could then go through and remove the
entry. To remove a specific ACL entry, we're looking at setfacl
‑x, and the entry for user tux.
We can, of course, add entries in for groups as well.
So if we want to add the wheel group into the ACL, we
can do so giving them, in this case, read and execute.
Another thing that we can do is back up and restore ACLs. So
just redirecting the output through to a file is the method
that we can use to back up the ACL.
We can remove the complete ACL, not just an individual
entry but the complete ACL, with the ‑b, so there is no
ACL now on our private directory.
We can restore that with setfacl ‑‑restore and reading in from the file.
And, of course, then there are a few switches for us to take a look at here, and
we need to go through and get used to using these commands. So let's go through and find ourselves a command line.