3:32 a.m.
On pe, 17 touko 2019, Jim Rice via FreeIPA-users wrote:
Does FreeIPA support ACL's, as in getfacl, setfacl?
entry_type:[uid|gid]:perms
You mean POSIX ACLs, not UNIX ACLs (there is not such
thing)?
POSIX ACLs are stored on disk with uid/gid as numbers. As such, Linux kernel
does not care what they resolve to by the user space processes, so any
provider that resolves them consistently is supporting them.
To answer directly: yes, using POSIX ACLs on file systems that support
them will work on IPA-enrolled clients.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
9:20 a.m.
Thank you Alexander.
I just wanted to differentiate between user/group ownership/permissions ACL's
and CA ACL and certificates. Yes, POSIX.
Can ACL's be managed through FreeIPA?
Assigning them to users and groups, establishing defaults, making changes
on a per user, per host, or via group settings basis?
Or does this have to happen with CLI commands issued on individual hosts?
On Saturday, May 18, 2019, 1:33:04 AM PDT, Alexander Bokovoy
<abokovoy(a)redhat.com> wrote:
On pe, 17 touko 2019, Jim Rice via FreeIPA-users wrote:
Does FreeIPA support ACL's, as in getfacl, setfacl?
entry_type:[uid|gid]:perms
You mean POSIX ACLs, not UNIX ACLs (there is not such
thing)?
POSIX ACLs are stored on disk with uid/gid as numbers. As such, Linux kernel
does not care what they resolve to by the user space processes, so any
provider that resolves them consistently is supporting them.
To answer directly: yes, using POSIX ACLs on file systems that support
them will work on IPA-enrolled clients.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
9:49 a.m.
On la, 18 touko 2019, jmrice6640(a)yahoo.com wrote:
Thank you Alexander.
I just wanted to differentiate between user/group ownership/permissions ACL's
and CA ACL and certificates. Yes, POSIX.
Can ACL's be managed through FreeIPA?
Assigning them to users and groups, establishing defaults, making changes
on a per user, per host, or via group settings basis?
No, POSIX ACLs don't work
this (centralized) way.
Or does this have to happen with CLI commands issued on individual
hosts?
POSIX ACLs are properties of each mounted file system that supports
them. They are associated with a particular file or folder and have
nothing to do with actual users or groups. So yes, it has to be done on
each individual host.
You can backup/restore POSIX ACLs with the help of utilities that
support it.
For GNU tar the support for POSIX ACLs exists since 1.27 (~2013), see this info page:
info tar 'extended file attributes'
For rsync, use -X and -A (POSIX xattrs and POSIX ACLs) options
Again, on IPA clients this will work fine as long as the client is
capable to resolve user and group names in a normal way (through SSSD).
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
1805
days inactive
1806
days old
freeipa-users@lists.fedorahosted.org
3 comments
3 participants
participants (3)
-
Alexander Bokovoy -
Jim Rice -
jmrice6640＠yahoo.com