[Freeipa-users] Re: UNIX ACL's
On la, 18 touko 2019, jmrice6640(a)yahoo.com wrote:
Thank you Alexander.
I just wanted to differentiate between user/group ownership/permissions ACL's
and CA ACL and certificates. Yes, POSIX.
Can ACL's be managed through FreeIPA?
Assigning them to users and groups, establishing defaults, making changes
on a per user, per host, or via group settings basis?
No, POSIX ACLs don't work
this (centralized) way.
Or does this have to happen with CLI commands issued on individual
hosts?
POSIX ACLs are properties of each mounted file system that supports
them. They are associated with a particular file or folder and have
nothing to do with actual users or groups. So yes, it has to be done on
each individual host.
You can backup/restore POSIX ACLs with the help of utilities that
support it.
For GNU tar the support for POSIX ACLs exists since 1.27 (~2013), see this info page:
info tar 'extended file attributes'
For rsync, use -X and -A (POSIX xattrs and POSIX ACLs) options
Again, on IPA clients this will work fine as long as the client is
capable to resolve user and group names in a normal way (through SSSD).
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland