Where are ACL permissions saved?

armandino · 07-02-2007, 12:21 PM

I learned that, provided I have the right packages and kernel modules (which are already there, for example, in Fedora), I can mount an ext2/3 fs with the "acl" option and then use the getfacl/setfacl command to set permissions on a user/group basis.

Where are those informations saved?
I suppose in the mounted file system, as they should "stay" with the files and folders they are referring to. However, they can NOT be in the inodes, which are already... full with standard Unix permissions.

Moreover, are they lost in case, after setting them, I should mount the same fs WITHOUT the "acl" option? Or do they stay there (where?), with no effect, until the fs gets "acl" mounted again?

Thanks

unixpgmr · 07-03-2007, 11:18 AM

I can't speak specifically to linux and ext3, but usually they are stored in the first inode that the file resides on. Consequently, they should still be there if you mount without ACL option. However, if you use a kernel that does not support extended attributes and write to the files system, you could have issues. A warning about ACLs: The acl can go away in certain circumstances. For example, if you set a read-only acl on one of your log files. Don't expect the acl to be there after a log rotate. When that file is deleted, the acl goes away - even if you create a new file with the same name. New file=new inode. Hope this helps.

Quote:

Originally Posted by armandino

I learned that, provided I have the right packages and kernel modules (which are already there, for example, in Fedora), I can mount an ext2/3 fs with the "acl" option and then use the getfacl/setfacl command to set permissions on a user/group basis.

Where are those informations saved?
I suppose in the mounted file system, as they should "stay" with the files and folders they are referring to. However, they can NOT be in the inodes, which are already... full with standard Unix permissions.

Moreover, are they lost in case, after setting them, I should mount the same fs WITHOUT the "acl" option? Or do they stay there (where?), with no effect, until the fs gets "acl" mounted again?

Thanks

armandino · 07-04-2007, 03:03 AM

Quote:

Originally Posted by unixpgmr

I can't speak specifically to linux and ext3, but usually they are stored in the first inode that the file resides on...

Thanks a lot.

What happens then when you enable acl (by remounting with the acl option) on an existent ext3 filesystem and apply acl rules to files which had been saved before?

Aren't the first inodes already full of data?
Are the data moved from the first inode (to where?) to make space for acl stuff?

unixpgmr · 07-04-2007, 11:39 PM

Usually, filesystems that have the ability to use acls, generally have space available for acls whether you have them enabled or not. Consequently, if you don't use them, it is space not used within the inode (part of the data structure that makes up the inode). Take a look here: http://www.suse.de/~agruen/acl/linux-acls/online/ Scroll down to the ext2/ext3 section. It should give you some good information. I know that the article is somewhat dated, but it does give some good basic information. I should say that I am not a filesystem developer. My experience with ACLs and Mandatory Access Controls are with a different operating system. So specific implementation issues may be different. I hope that this helps.

Quote:

Originally Posted by armandino

Thanks a lot.

What happens then when you enable acl (by remounting with the acl option) on an existent ext3 filesystem and apply acl rules to files which had been saved before?

Aren't the first inodes already full of data?
Are the data moved from the first inode (to where?) to make space for acl stuff?

armandino · 07-05-2007, 01:44 AM

It surely helps, a lot.
Thank you very much.

GregLee · 07-05-2007, 11:56 AM

Quote:

Originally Posted by armandino

What happens then when you enable acl (by remounting with the acl option) on an existent ext3 filesystem and apply acl rules to files which had been saved before?

What Fedora has are extended file attributes for ext3 (and xfs, I suppose) filesystems. This seems similar to acls, but I don't know the relationship between the two. Attrs are used for Secure Linux. To answer the question you asked about acls for attrs, when you enable SELinux, on the next reboot, file attributes are set according to whatever policies are in effect (takes awhile). These extended file attributes do not need to be enabled with a special mounting option in Fedora 6 -- they're the default. You see them with "ls -Z".

unixpgmr · 07-05-2007, 11:46 PM

Actually, when you use ls -Z you see something quite different than ACLs - you see something called type enforcement. It is similar to MAC (Mandatory Access Control) labels. The relationship of extended attributes and acls is that both are stored in the inodes and both are used to enhance security on various operating systems. Extended Attributes are not specifically for securing linux, but are a tool to that end. Having extended attributes doesn't secure a linux system. The application of extended attributes can help secure a linux system. Yes xfs has extended attributes as well as ACLs.

Quote:

Originally Posted by GregLee

What Fedora has are extended file attributes for ext3 (and xfs, I suppose) filesystems. This seems similar to acls, but I don't know the relationship between the two. Attrs are used for Secure Linux. To answer the question you asked about acls for attrs, when you enable SELinux, on the next reboot, file attributes are set according to whatever policies are in effect (takes awhile). These extended file attributes do not need to be enabled with a special mounting option in Fedora 6 -- they're the default. You see them with "ls -Z".