jperezduerto.info
Security in depth · Unit 22 · Lesson 5 of 44
ACLs add named permissions
Calculate effective named-user rights from an entry and its mask.
Helpful before thisLinux privilege escalation
After this lesson you can
- Apply a POSIX ACL mask without confusing it with every entry’s permissions.
One idea. One situation. One reasoned decision.
How it works
A POSIX access control list can describe permissions for named users and groups beyond the basic owner, group, and other classes. Its mask limits permissions of named-user and group-class entries; it is not a blanket limit on every entry. Default directory ACLs influence permissions inherited by newly created objects. Review effective permissions and inheritance together, because a short mode display may hide relevant detail.
Read the supplied record
This is a simplified excerpt from a fictional file’s valid access ACL. Maya is neither the owner nor a privileged process; the path is searchable.
| Entry | Listed rights |
|---|---|
| Named user Maya | Read and write |
| Mask | Read |
The effective rights from Maya’s entry are read only. The mask limits the entry; it does not manufacture rights that the entry lacks. The owning user’s entry and the other entry are outside this mask’s scope.
Suppose an approved requirement later needs Maya to edit. Changing the mask can also affect other entries it limits. A reviewer should inspect those entries before recommending a broader mask, and preserve unrelated restrictions. The visible group mode bits may represent the mask rather than just the owning group’s entry.
Finally, separate the current access ACL from a directory’s default ACL, which affects creation. One record does not establish both present access and future inheritance.
The key distinction: Named permissions and their effective limits must be interpreted together.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
A named-user entry gives Maya read/write, while the ACL mask permits only read. Maya is not the owner. What does this entry effectively grant?
Show the answer
Correct answer: Read only, subject to other applicable controls. The named-user entry is limited by the mask. Write is present in the entry but absent from its effective rights.
Try it
- WriteFor the supplied named-user entry, list the requested and effective rights. Explain why widening the shared mask requires reviewing other affected entries too.