PDA

View Full Version : Using ACLs with Fedora Core 2


immerv
4th June 2004, 03:33 AM
I just finished writing a tutorial/HOWTO on using filesystem ACLs on Fedora Core 2. It's too long to post here, but here is the link:

http://www.vanemery.com/Linux/ACL/linux-acl.html

ACLs let users have detailed control over file and directory permissions. Any feedback would be welcome!

Thanks,

Van

foolish
4th June 2004, 04:13 AM
Great guide, very detailed and good. Nice formating (css) on this one too. Thank you.

ndv
4th June 2004, 05:46 AM

you DESERVE feedback!
this is the best and far most clear and plain howto I ever read.

well you don't specify if it is possible, risky or just impossible to set acl's on the / filesystem.

as a windows system administrator i'd like to administer linux boxes with acl's instead of create billions of groups...

anyhow thanks!
nicola

immerv
4th June 2004, 12:57 PM
To the moderator and Nicola,

Thanks for the comments. Nicola, on the issue of using ACLs on the root partition, this actually does work. However, in the Grünbacher paper performance is discussed. Initial file access is much slower with EXT3/EXT2 when it has to check ACLs. So, I discouraged using it in the / partition for two reasons:

1. It is easy to put a typo into the /etc/fstab file when you modify / . Then it's rescue disk time! (This happened to me)

2. I don't see any reason to use ACLs on things like /etc, /bin, /sbin, /usr/bin, /usr/sbin, /usr/lib . These things should load fast without ACL checks. This is the performance angle.

ACLs and disk quotas are (IMHO) best used in /var, /tmp, /home and User/App data directories.

Plus, Linux ACLs are still a bit experimental...

Best Regards,

Van

praveen_nadar
23rd August 2004, 08:15 PM
HelloVan...


I am not able to access your site....

praveen_nadar
23rd August 2004, 08:15 PM
Not able to access your site

maxnort
7th September 2004, 05:06 PM
looks like a nice guide. I just found it; now I get to test it. I'm relatively new to linux. if I have a problem understanding, I'll let you know.

I may quote the entire thing, unless you have a problem with that.