LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Other *NIX Forums > AIX
User Name
Password
AIX This forum is for the discussion of IBM AIX.
eserver and other IBM related questions are also on topic.

Notices


Reply
  Search this Thread
Old 11-02-2019, 07:01 PM   #1
nirvaanr
LQ Newbie
 
Registered: Jun 2016
Posts: 24

Rep: Reputation: Disabled
Unable to set ACLs on sulog file - need to grant read permission to a normal user on AIX 6.1


Hi,

I need to grant read permission to a normal user on sulog file on AIX 6.1.

As root, I did "acledit sulog" and "aclget" shows "extended permissions" as "enabled" and normal user "splunk" has read permissions.

When I try to access sulog file as "splunk" user it won't allow and "aclget" for splunk user shows "extended permissions" as "disabled".

I also tried to remound /var with "acl" option, it throws "Invalid mount option"..

Please advise, thanks!!

Code:
splunk@TESTAIX61(/var/adm)#  uname -a
AIX TESTAIX61 1 6 00CACC954C00
splunk@TESTAIX61(/var/adm)#  oslevel -s
6100-09-12-1838
splunk@TESTAIX61(/var/adm)#
root@TESTAIX61(/var/adm)#  acledit sulog
Should the modified ACL be applied? (yes) or (no) yes
root@TESTAIX61(/var/adm)#   aclget sulog
*
* ACL_type   AIXC
*
attributes:
base permissions
    owner(root):  rw-
    group(system):  ---
    others:  ---
extended permissions
    enabled
    permit   r-x     u:splunk
root@TESTAIX61(/var/adm)#  su - splunk
splunk@TESTAIX61(/home/splunk)#  tail /var/adm/sulog
/var/adm/sulog: Permission denied
splunk@TESTAIX61(/home/splunk)#  id
uid=228(splunk) gid=206(splunk) groups=1(staff)
splunk@TESTAIX61(/home/splunk)#  cd /var/adm
splunk@TESTAIX61(/var/adm)#  aclget sulog
*
* ACL_type   AIXC
*
attributes:
base permissions
    owner(root):  rw-
    group(system):  ---
    others:  ---
extended permissions
    disabled
    permit   r-x     u:splunk
splunk@TESTAIX61(/var/adm)#
 
Old 11-03-2019, 09:15 AM   #2
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 22,127

Rep: Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921
Quote:
Originally Posted by nirvaanr View Post
Hi,
I need to grant read permission to a normal user on sulog file on AIX 6.1.

As root, I did "acledit sulog" and "aclget" shows "extended permissions" as "enabled" and normal user "splunk" has read permissions. When I try to access sulog file as "splunk" user it won't allow and "aclget" for splunk user shows "extended permissions" as "disabled". I also tried to remound /var with "acl" option, it throws "Invalid mount option"..

Please advise, thanks!!
Code:
splunk@TESTAIX61(/var/adm)#  uname -a
AIX TESTAIX61 1 6 00CACC954C00
splunk@TESTAIX61(/var/adm)#  oslevel -s
6100-09-12-1838
splunk@TESTAIX61(/var/adm)#
root@TESTAIX61(/var/adm)#  acledit sulog
Should the modified ACL be applied? (yes) or (no) yes
root@TESTAIX61(/var/adm)#   aclget sulog
*
* ACL_type   AIXC
*
attributes:
base permissions
    owner(root):  rw-
    group(system):  ---
    others:  ---
extended permissions
    enabled
    permit   r-x     u:splunk
root@TESTAIX61(/var/adm)#  su - splunk
splunk@TESTAIX61(/home/splunk)#  tail /var/adm/sulog
/var/adm/sulog: Permission denied
splunk@TESTAIX61(/home/splunk)#  id
uid=228(splunk) gid=206(splunk) groups=1(staff)
splunk@TESTAIX61(/home/splunk)#  cd /var/adm
splunk@TESTAIX61(/var/adm)#  aclget sulog
*
* ACL_type   AIXC
*
attributes:
base permissions
    owner(root):  rw-
    group(system):  ---
    others:  ---
extended permissions
    disabled
    permit   r-x     u:splunk
splunk@TESTAIX61(/var/adm)#
What are the standard ("ls -l") permissions on that file? Did you try to enable the ACL for the splunk group for read/execute permission as well?
Code:
 permit    rw-    g:splunk
It looks like that file is only rw for root only. If the group ACL doesn't work, just changing permissions to 604 (rw----r--) will allow read-only access on that file, and read/write for only root.
 
Old 11-03-2019, 07:59 PM   #3
nirvaanr
LQ Newbie
 
Registered: Jun 2016
Posts: 24

Original Poster
Rep: Reputation: Disabled
The standard permissions are 600 for sulog file.

Tried with group ACL as well but did not work (same behaviour)

setting read permissions for group/others is not an option.

Thanks!
 
Old 11-04-2019, 08:06 AM   #4
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 22,127

Rep: Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921Reputation: 5921
Quote:
Originally Posted by nirvaanr View Post
The standard permissions are 600 for sulog file.
Right.
Quote:
Tried with group ACL as well but did not work (same behaviour)
Odd, since that should work (even without the group), but you are using a *VERY* old version of AIX. Have you looked into the aclput command?
http://public.dhe.ibm.com/systems/po...xcmds1_pdf.pdf
Quote:
setting read permissions for group/others is not an option.
Why is that?? And again, we have NO IDEA what your restrictions are unless you tell us.
 
Old 11-12-2019, 04:27 AM   #5
NevemTeve
Senior Member
 
Registered: Oct 2011
Location: Budapest
Distribution: Debian/GNU/Linux, AIX
Posts: 3,904

Rep: Reputation: 1382Reputation: 1382Reputation: 1382Reputation: 1382Reputation: 1382Reputation: 1382Reputation: 1382Reputation: 1382Reputation: 1382Reputation: 1382
If it were me, I'd start with testfiles, eg:
Code:
$ touch acl_testfile
$ aclget acl_testfile >acl_testfile.acl
$ cp acl_testfile.acl acl_testfile.orig_acl
$ edit acl_testfile.acl
$ aclput -i acl_testfile.acl acl_testfile
$ cat acl_testfile.orig_acl
*
* ACL_type   AIXC
*
attributes: 
base permissions
    owner(projects):  rw-
    group(devel):  rw-
    others:  r--
extended permissions
    disabled
$ cat acl_testfile.acl
*
* ACL_type   AIXC
*
attributes: 
base permissions
    owner(projects):  rw-
    group(devel):  rw-
    others:  r--
extended permissions
    enabled
        permit    rw-    u:zsiga
So I've added an extra 'rw' right to user 'zsiga'

Edit: if the problem is specific to this 'sulog' file, then it might be intentional, e.g. every run of program 'su' disables ACL on this file.

Last edited by NevemTeve; 11-13-2019 at 12:56 AM.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
is it possible that normal user should not able to remove crontab which was set by superuser for this normal user? gjoshi Linux - Newbie 1 04-02-2019 01:30 AM
Grant user to read only permission linuxmantra Linux - Newbie 12 04-22-2014 07:26 AM
How to grant permission to mount ntfs file system for normal user m.parthiban Fedora 3 02-21-2010 10:17 AM
SYSLOG_SU_ENAB yes SULOG_FILE /var/log/sulog is not working .. udayakumarsv Linux - Security 4 01-29-2008 06:40 AM

LinuxQuestions.org > Forums > Other *NIX Forums > AIX

All times are GMT -5. The time now is 05:24 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration