4 ms·

I like the changing of the default umask, although it probably shouldn't be 077. Is acl needed over, say, chown?

by mmsc 3y ago

chris_st 3y ago
Why not 077?
- bravetraveler 3y ago
  It effectively makes group ownership meaningless. 027 does a better job of keeping the model while tightening it up - worldly permissions are removed, users and groups are still meaningful. This is what they're supplementing with ACLs, creating a frustrating problem of discovery by managing groups of users outside of groups It's not necessarily wrong, I guess. There may be cases where someone wants this. ACLs are an answer, just not the one I'd suggest. Why? Imagine 'Bob' leaves. Do you want to remove them from countless ACLs, or one group? One is probably better off with 027, using groups, and focusing on SELinux or AppArmor. It will permit or deny things based on many things, including user context. Bonus: it isn't limited to assets on disk. Things like gaining a shell and proxying services can be denied.
- deleted 3y ago
  [deleted]
cutler 3y ago
If not 077 then what?
- linuxdude314 3y ago
  077 is a bit too restrictive for a lot of workloads. 027 is recommended by CIS for servers and 022 for desktop. If you are sure you can use 077 without stuff breaking, awesome, but that's not always the case. Typically on systems using 077 you will find yourself using chmod a lot.
aesh2Xa1 3y ago
No, there's no need to use `setfacl` over `chown/chmod` in the author's example. The reason that the author uses umask 077 and ACLs is, I think, just a mindset. By using 077, the file is restricted to only the owner, and the sysadmin does not need to think about group memberships. By extending read access using an ACL, this theme is continued; additional usernames will be appended as ACLs, but no group set of usernames needs to exist. A file named "alfred" would, presumably, only ever needed to be read by root and alfred, but that's just the narrow case for the author's scheme.

I like the changing of the default umask, although it probably shouldn't be 077. Is acl needed over, say, chown?

by mmsc 3y ago

I like the changing of the default umask, although it probably shouldn't be 077. Is acl needed over, say, chown?

chris_st 3y ago

Why not 077?

bravetraveler 3y ago
It effectively makes group ownership meaningless. 027 does a better job of keeping the model while tightening it up - worldly permissions are removed, users and groups are still meaningful. This is what they're supplementing with ACLs, creating a frustrating problem of discovery by managing groups of users outside of groups It's not necessarily wrong, I guess. There may be cases where someone wants this. ACLs are an answer, just not the one I'd suggest. Why? Imagine 'Bob' leaves. Do you want to remove them from countless ACLs, or one group? One is probably better off with 027, using groups, and focusing on SELinux or AppArmor. It will permit or deny things based on many things, including user context. Bonus: it isn't limited to assets on disk. Things like gaining a shell and proxying services can be denied.
deleted 3y ago
[deleted]

cutler 3y ago

If not 077 then what?

linuxdude314 3y ago
077 is a bit too restrictive for a lot of workloads. 027 is recommended by CIS for servers and 022 for desktop. If you are sure you can use 077 without stuff breaking, awesome, but that's not always the case. Typically on systems using 077 you will find yourself using chmod a lot.

aesh2Xa1 3y ago

No, there's no need to use `setfacl` over `chown/chmod` in the author's example. The reason that the author uses umask 077 and ACLs is, I think, just a mindset. By using 077, the file is restricted to only the owner, and the sysadmin does not need to think about group memberships. By extending read access using an ACL, this theme is continued; additional usernames will be appended as ACLs, but no group set of usernames needs to exist. A file named "alfred" would, presumably, only ever needed to be read by root and alfred, but that's just the narrow case for the author's scheme.