Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #211669 > unrolled thread

clone ACL permissions

Back to article view | Back to linux.debian.user

Contents

  clone ACL permissions Adam Weremczuk <adamw@matrixscience.com> - 2019-07-23 13:10 +0200
    Re: clone ACL permissions "Thomas Schmitt" <scdbackup@gmx.net> - 2019-07-23 13:30 +0200
      Re: clone ACL permissions Adam Weremczuk <adamw@matrixscience.com> - 2019-07-23 13:50 +0200
    Re: clone ACL permissions Teemu Likonen <tlikonen@iki.fi> - 2019-07-23 13:30 +0200

#211669 — clone ACL permissions

Hi all,

I've just found out that my backups were missing ACL and the restore 
will not work until this is fixed.

Luckily I have the luxury of checking what the permissions should look 
like on a running system, e.g:

RESTORED:

# file: samba/sysvol
# owner: root
# group: 3000000
user::rwx
group::rwx
other::---

RUNNING:

# file: samba/sysvol
# owner: root
# group: 3000000
user::rwx
user:root:rwx
group::rwx
group:3000000:rwx
group:3000001:r-x
group:3000002:rwx
group:3000003:r-x
mask::rwx
other::---
default:user::rwx
default:user:root:rwx
default:group::---
default:group:3000000:rwx
default:group:3000001:r-x
default:group:3000002:rwx
default:group:3000003:r-x
default:mask::rwx
default:other::---

There are no trivial permissions patterns to follow so manual 
reconciliation would take very long and be error prone.

QUESTION:

Is it possible to "clone" ACL permissions?

I.e. recursively read ACL (getfacl?) on all files and folders and write 
(setacl?) to the same list of files and folders elsewhere?

Thanks,
Adam

[toc] | [next] | [standalone]

#211670

Hi,

consider this from man setfacl:

   --restore=file
       Restore a permission backup created by `getfacl -R' or similar. All
       permissions of a complete directory subtree are restored using this
       mechanism. If the input contains owner comments or group  comments,
       setfacl  attempts  to  restore  the  owner and owning group. If the
       input contains flags comments (which define the setuid, setgid, and
       sticky bits), setfacl sets those three bits accordingly; otherwise,
       it clears them. This option cannot  be  mixed  with  other  options
       except `--test'.

You could write a program which reads the text blocks in the getfacl -R
file and only writes those to a new file, which contain lines other than
the chmod-related "user::", "group::", "other::".
This would curb the eagerness of setfacl --restore to the files which
really need it.

Depending on your situation. some manipulation of the file paths in the -R
file might be necessary.

(And of course you urgently need a backup of your ACLs. If your favorite
 backup tool does not record them, consider to run getfacl -R and to
 include the resulting file in your backup.)


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#211672

On 23/07/19 12:20, Thomas Schmitt wrote:

> Hi,
>
> consider this from man setfacl:
>
>     --restore=file
>         Restore a permission backup created by `getfacl -R' or similar. All
>         permissions of a complete directory subtree are restored using this
>         mechanism. If the input contains owner comments or group  comments,
>         setfacl  attempts  to  restore  the  owner and owning group. If the
>         input contains flags comments (which define the setuid, setgid, and
>         sticky bits), setfacl sets those three bits accordingly; otherwise,
>         it clears them. This option cannot  be  mixed  with  other  options
>         except `--test'.
>
> You could write a program which reads the text blocks in the getfacl -R
> file and only writes those to a new file, which contain lines other than
> the chmod-related "user::", "group::", "other::".
> This would curb the eagerness of setfacl --restore to the files which
> really need it.
>
> Depending on your situation. some manipulation of the file paths in the -R
> file might be necessary.
>
> (And of course you urgently need a backup of your ACLs. If your favorite
>   backup tool does not record them, consider to run getfacl -R and to
>   include the resulting file in your backup.)
>
>
> Have a nice day :)
>
> Thomas
>
Hi Thomas,

Thank you for a quick and useful reply.
I definitely need to review all backups and include ACLs where needed.
I'm also wondering if rsync is capable of syncing ACLs without touching 
anything else.
I vaguely recall using it for a similar purpose some time ago.

Thanks,
Adam

[toc] | [prev] | [next] | [standalone]

#211671

[Multipart message — attachments visible in raw view] — view raw

Adam Weremczuk [2019-07-23T11:42:00+01] wrote:

> Is it possible to "clone" ACL permissions?
>
> I.e. recursively read ACL (getfacl?) on all files and folders and
> write (setacl?) to the same list of files and folders elsewhere?

Maybe rsync's -A/--acls option is useful here.

    rsync --verbose --archive --acls --dry-run somewhere/ somewhere-else

-- 
///  OpenPGP key: 4E1055DC84E9DFF613D78557719D69D324539450
//  https://keys.openpgp.org/search?q=tlikonen@iki.fi
/  https://keybase.io/tlikonen  https://github.com/tlikonen

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web