Unable to set ACLs on sulog file - need to grant read permission to a normal user on AIX 6.1

Hi,

I need to grant read permission to a normal user on sulog file on AIX 6.1.

As root, I did "acledit sulog" and "aclget" shows "extended permissions" as "enabled" and normal user "splunk" has read permissions.

When I try to access sulog file as "splunk" user it won't allow and "aclget" for splunk user shows "extended permissions" as "disabled".

I also tried to remound /var with "acl" option, it throws "Invalid mount option"..

Please advise, thanks!!

splunk@TESTAIX61(/var/adm)#  uname -a
AIX TESTAIX61 1 6 00CACC954C00
splunk@TESTAIX61(/var/adm)#  oslevel -s
6100-09-12-1838
splunk@TESTAIX61(/var/adm)#
root@TESTAIX61(/var/adm)#  acledit sulog
Should the modified ACL be applied? (yes) or (no) yes
root@TESTAIX61(/var/adm)#   aclget sulog
*
* ACL_type   AIXC
*
attributes:
base permissions
    owner(root):  rw-
    group(system):  ---
    others:  ---
extended permissions
    enabled
    permit   r-x     u:splunk
root@TESTAIX61(/var/adm)#  su - splunk
splunk@TESTAIX61(/home/splunk)#  tail /var/adm/sulog
/var/adm/sulog: Permission denied
splunk@TESTAIX61(/home/splunk)#  id
uid=228(splunk) gid=206(splunk) groups=1(staff)
splunk@TESTAIX61(/home/splunk)#  cd /var/adm
splunk@TESTAIX61(/var/adm)#  aclget sulog
*
* ACL_type   AIXC
*
attributes:
base permissions
    owner(root):  rw-
    group(system):  ---
    others:  ---
extended permissions
    disabled
    permit   r-x     u:splunk
splunk@TESTAIX61(/var/adm)#

Originally Posted by nirvaanr Hi, I need to grant read permission to a normal user on sulog file on AIX 6.1. As root, I did "acledit sulog" and "aclget" shows "extended permissions" as "enabled" and normal user "splunk" has read permissions. When I try to access sulog file as "splunk" user it won't allow and "aclget" for splunk user shows "extended permissions" as "disabled". I also tried to remound /var with "acl" option, it throws "Invalid mount option".. Please advise, thanks!! splunk@TESTAIX61(/var/adm)# uname -a AIX TESTAIX61 1 6 00CACC954C00 splunk@TESTAIX61(/var/adm)# oslevel -s 6100-09-12-1838 splunk@TESTAIX61(/var/adm)# root@TESTAIX61(/var/adm)# acledit sulog Should the modified ACL be applied? (yes) or (no) yes root@TESTAIX61(/var/adm)# aclget sulog * * ACL_type AIXC * attributes: base permissions owner(root): rw- group(system): --- others: --- extended permissions enabled permit r-x u:splunk root@TESTAIX61(/var/adm)# su - splunk splunk@TESTAIX61(/home/splunk)# tail /var/adm/sulog /var/adm/sulog: Permission denied splunk@TESTAIX61(/home/splunk)# id uid=228(splunk) gid=206(splunk) groups=1(staff) splunk@TESTAIX61(/home/splunk)# cd /var/adm splunk@TESTAIX61(/var/adm)# aclget sulog * * ACL_type AIXC * attributes: base permissions owner(root): rw- group(system): --- others: --- extended permissions disabled permit r-x u:splunk splunk@TESTAIX61(/var/adm)#

What are the standard ("ls -l") permissions on that file? Did you try to enable the ACL for the splunk group for read/execute permission as well?

 permit    rw-    g:splunk

It looks like that file is only rw for root only. If the group ACL doesn't work, just changing permissions to 604 (rw----r--) will allow read-only access on that file, and read/write for only root.

The standard permissions are 600 for sulog file.

Tried with group ACL as well but did not work (same behaviour)

setting read permissions for group/others is not an option.

Thanks!

Originally Posted by nirvaanr The standard permissions are 600 for sulog file.

Right.

Tried with group ACL as well but did not work (same behaviour)

Odd, since that should work (even without the group), but you are using a *VERY* old version of AIX. Have you looked into the aclput command?
http://public.dhe.ibm.com/systems/po...xcmds1_pdf.pdf

setting read permissions for group/others is not an option.

Why is that?? And again, we have NO IDEA what your restrictions are unless you tell us.

If it were me, I'd start with testfiles, eg:

$ touch acl_testfile
$ aclget acl_testfile >acl_testfile.acl
$ cp acl_testfile.acl acl_testfile.orig_acl
$ edit acl_testfile.acl
$ aclput -i acl_testfile.acl acl_testfile
$ cat acl_testfile.orig_acl
*
* ACL_type   AIXC
*
attributes: 
base permissions
    owner(projects):  rw-
    group(devel):  rw-
    others:  r--
extended permissions
    disabled
$ cat acl_testfile.acl
*
* ACL_type   AIXC
*
attributes: 
base permissions
    owner(projects):  rw-
    group(devel):  rw-
    others:  r--
extended permissions
    enabled
        permit    rw-    u:zsiga

So I've added an extra 'rw' right to user 'zsiga'

Edit: if the problem is specific to this 'sulog' file, then it might be intentional, e.g. every run of program 'su' disables ACL on this file.