prior to running this script please keep the following in mind:
0. your system must support acl, if it doesn't please google to find out how you can.
1. you will need to edit the aclset.sh file and make some changes as suggested there.
2. VALID_USERS must have rwx permissions to RESTRICTED_DIRECTORY
3. please make sure aclset.sh file only has rx permissions for everbody except root
4. setfacl command is better than this if you know how to use it
5. help file is not available
i only wrote this because i had to (in my situation). basically, this script facilitates users other than root to set acl's for some other users.
feedbacks(any kind) are welcome
!
Code:
#!/bin/sh
##################################################################
## filename : aclset.sh
## version : 1.0
## author : prozac
## date created : 3 JANUARY 2006
## summary : script to set acl's in directories
##################################################################
##################################################################
### Definitions
##################################################################
LOGFILE=".aclset.log" # logfile name
RESTRICTED_PATH="" # enter the absolute path to the restricted directory
HOME_PATH="" # absolute path to the directory where 'aclset.sh' resides
VALID_USERS="" # system users who can run this script
TAIL_LINES="10"
UNFIT="0"
FIT="1"
SUCCESS="0"
FAILED="1"
READ="r"
READ_WRITE="rw"
READ_EXECUTE="rx"
READ_WRITE_EXECUTE="rwx"
CURRENT_USER=$LOGNAME
###################################################################
### Functions
###################################################################
### set acl for which directory?
get_path()
{
while [ "$UNFIT" -ne "$FIT" ];
do
read -e -p "directory:" FILENAME
if [ ! -z "$FILENAME" ]; then
if [ -e $FILENAME ]; then
if [ -d $FILENAME ]; then
scope_check;
else
echo "'$FILENAME' is a not a directory!"
fi
else
echo "directory '$FILENAME' doesn't exists!"
fi
else
main;
fi
done
UNFIT="0"
}
### set acl for which user?
get_user()
{
while [ "$UNFIT" -ne "$FIT" ];
do
read -e -p "username:" USER
if [ ! -z "$USER" ]; then
id $USER > /dev/null;
if [ "$?" -eq "$SUCCESS" ]; then
UNFIT=$FIT
else
echo "'$USER': doesn't exists!"
fi
else
get_path;
fi
done
UNFIT="0"
}
### what kind of acl?
get_perm()
{
while [ "$UNFIT" -ne "$FIT" ];
do
read -e -p "permission:" PERMISSION
if [ ! -z $PERMISSION ]; then
if [ "$PERMISSION" == "$READ" ] || [ "$PERMISSION" == "$READ_WRITE" ] || [ "$PERMISSION" == "$READ_EXECUTE" ] || [ "$PERMISSION" == "$READ_WRITE_EXECUTE" ]; then
UNFIT=$FIT
else
echo "USAGE:'permission can only be r,rw,rx or rwx!"
fi
else
get_user;
fi
done
UNFIT="0"
}
### backup acl's before attempting to set new
get_acl()
{
echo "------------------------------" >> $LOGFILE;
echo "`getfacl $FILENAME`" >> $LOGFILE;
echo "------------------------------" >> $LOGFILE;
}
### all information in hand, now set acl
set_acl()
{
get_acl; # take backup first
setfacl -R -m u:$USER:$PERMISSION $FILENAME
if [ "$?" -eq "$SUCCESS" ]; then
echo "acl added for $FILENAME with $USER = $PERMISSION";
echo "MODIFY SUCCESS! <$USER:$PERMISSION:$FILENAME>" >> $LOGFILE;
else
echo "MODIFY FAILED! <$USER:$PERMISSION:$FILENAME>" >> $LOGFILE;
fi
}
### revoke acl for given user
revoke_acl()
{
get_path;
get_user;
get_acl; # take backup first
setfacl -x u:$USER $FILENAME
if [ "$?" -eq "$SUCCESS" ]; then
echo "REVOKE SUCCESS! <$USER:$FILENAME>" >> $LOGFILE;
echo "acl revoke successful!"
else
echo "REVOKE FAILED! <$USER:$FILENAME>" >> $LOGFILE;
echo "acl revoke failed!"
fi
}
### list acl for given directory
list_acl()
{
get_path;
echo "=================================================================================="
echo "current acl for $FILENAME"
echo "=================================================================================="
getfacl $FILENAME
echo "=================================================================================="
}
### restore previously applied acl's
restore_acl()
{
get_path;
get_acl; # take backup first
setfacl -b $FILENAME
if [ "$?" = "$SUCCESS" ]; then
echo "RESTORE SUCCESS! <$FILENAME>" >> $LOGFILE;
echo "all acl's restored successfully!"
else
echo "RESTORE FAILED! <$FILENAME>" >> $LOGFILE;
echo "Error! couldn't restore acl's"
fi
}
### display the help file
show_help()
{
more help.txt
}
### show transaction log
show_log()
{
if [ ! -e $LOGFILE ]; then
echo "sorry! no log files found"
else
read -e -p "Display last ?? lines [default 10]:" TAIL_LINES;
if [ "$TAIL_LINES" == "" ]; then
TAIL_LINES=10;
fi
echo "=================================================================================="
echo "displaying last $TAIL_LINES lines from $LOGFILE.."
echo "=================================================================================="
tail -$TAIL_LINES $LOGFILE;
echo "=================================================================================="
fi
}
### list all files in $RESTRICTED_PATH
show_files()
{
echo "=================================================================================="
echo "listing all directories recursively in $RESTRICTED_PATH"
echo "=================================================================================="
ls -lhXR --color=auto $RESTRICTED_PATH |grep ./ | sed s/://
echo "=================================================================================="
}
authenticate()
{
VALID=$FAILED;
for v in $VALID_USERS
do
if [ "$CURRENT_USER" == "$v" ]; then
VALID=$SUCCESS;
break;
fi
done
if [ "$VALID" -eq "$SUCCESS" ]; then
echo "`date`:Session opened by: $CURRENT_USER" >> $LOGFILE;
else
echo "$CURRENT_USER, cannot run this program for you!"
echo "`date`:Login attempt by: $CURRENT_USER" >> $LOGFILE;
read -e -s -n1 -p "hit any key to continue.." COMMAND
exit
fi
}
scope_check()
{
cd $FILENAME
ls -R $RESTRICTED_PATH |sed s/:// |grep `pwd` >> /dev/null
if [ "$?" -eq "$SUCCESS" ]; then
UNFIT=$FIT;
else
echo "Out of scope error! Scope is: $RESTRICTED_PATH"
fi
cd $HOME_PATH
}
###################################################################
### Main
###################################################################
main()
{
authenticate;
while [ "$UNFIT" -ne "$FIT" ];
do
clear;
COMMAND=""
FILENAME=""
USER=""
PERMISSION=""
i=0
# give a menu first
echo "---------------------------------------------------"
echo " aclset control panel "
echo "---------------------------------------------------"
echo "1. add/modify a user in acl "
echo "2. revoke user rights from acl "
echo "3. list acl for a directory "
echo "4. restore defaults "
echo "5. show all directories "
echo "6. help "
echo "---------------------------------------------------"
read -e -s -n1 -p "select[1-6/(q)uit]:" COMMAND
case $COMMAND in
1)
get_path;
get_user;
get_perm;
set_acl;
read -e -s -n1 -p "hit any key to return.." COMMAND
;;
2)
revoke_acl;
read -e -s -n1 -p "hit any key to return.." COMMAND
;;
3)
list_acl;
read -e -s -n1 -p "hit any key to return.." COMMAND
;;
4)
restore_acl;
read -e -s -n1 -p "hit any key to return.." COMMAND
;;
5)
show_files;
read -e -s -n1 -p "hit any key to return.." COMMAND
;;
6)
show_help;
;;
s)
show_log;
read -e -s -n1 -p "hit any key to return.." COMMAND
;;
q)
UNFIT=$FIT
;;
exit)
UNFIT=$FIT
;;
*)
echo "Please select a correct value!"
sleep 1
;;
esac
done
echo "`date`:Session closed by: $CURRENT_USER" >> $LOGFILE;
echo "===END===" >> $LOGFILE
exit;
}
main;
###################################################################
### End
###################################################################
does this user exists in the system?
aclset.sh
