UGO及ACL整合判斷流程圖如下:

對Linux U(User)G(Group)O(Other)權限認知都知道UGO權限限制。無法針對多使用者及多個群組做檔案的權限設定，因此就有ACL(Access Control Lists)計畫來補充UGO權限的不足。ACL是以 kernel-base方式來支援Linux

dumpe2fs /dev/mapper/VolGroup00-LogVol00 |grep -i Default
 
dumpe2fs 1.35 (28-Feb-2004)
Default mount options:    acl -->表示此系統有支援
Default directory hash:   tea

或是用tune2fs也可看到相關資訊

tune2fs -l /dev/mapper/VolGroup00-LogVol00 |grep -i Default

或是用 mount看相關ACL資訊

mount
/dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw,acl)
~略~

相反地，若無支援ACL如何讓檔案系統支援。兩種方法

1. 即刻生效(重新開機後,回覆成無支援ACL狀態)

   #mount -o remount,acl /dev/mapper/VolGroup00-LogVol00
   #mount 
   /dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw,acl)
   ~略~

2. 直接修改/etc/fstab或用tune2fs調整核心支援ACL

   vim /etc/fstab
   ~略~
   /dev/VolGroup00/LogVol00 /                       ext3    defaults,acl        1 1
   ~略~
   #mout -o remount /   -->重新掛載即生效
   或是重新開機 #sync;reboot

用tune2fs 掛 ACL或卸除 ACL 支援

#tune2fs -o +acl  /dev/mapper/VolGroup00-LogVol00

卸除ACL

#tune2fs -o ^acl  /dev/mapper/VolGroup00-LogVol00

用tune2fs工具調整核心來支援ACL,需要重新開機

#reboot

• getfacl 看acl權限

  #ls -l test
  ~略~
  -rw-r--r--  1 root root         0 Mar 28 11:28 test
  ~略~
   
  #getfacl test
   
  # file: test
  # owner: root
  # group: root
  user::rw-
  group::r--
  other::r--

• setfacl 設定acl權限

  #setfacl -[m|b|x](m,x不可一起服用)  [u|g|d|m]:[uid|使用者名稱]:rwx 檔案或目錄

  由上一個項目得知 test的權限為root rw。現在要加入一個使用者andy rw
  #setfacl -m u:andy:rw test  ==> -m 修改  u(使用者):帳號:權限
  # getfacl test
  
  # file: test
  # owner: root
  # group: root
  user::rw-
  user:andy:rw-
  group::r--
  mask::rw-
  other::r--
  #ls -l test
  -rw-rw-r--+ 1 root root         0 Mar 28 11:28 test -->設定完ACL,會出現+

  完全清除掉acl設定

  #setfacl -b test 
  #getfacl test
  # file: test
  # owner: root
  # group: root
  user::rw-
  group::r--
  other::r--
  #ls -l test
  -rw-r--r--  1 root root         0 Mar 28 11:28 test -->清掉所有的ACL,無+

  子目錄繼承ACL權限

  # mkdir test
  #setfacl -m u:andy:rwx test/
  #touch test/file{1..3}
  #ll test/
  -rw-r--r-- 1 root root 0 Mar 28 14:20 file1
  -rw-r--r-- 1 root root 0 Mar 28 14:20 file2
  -rw-r--r-- 1 root root 0 Mar 28 14:20 file3
  以上file1~file3都沒有 +(表示沒繼承)

  設定繼承的ACL

  # setfacl -x u:andy test/ (先清除acl單)
  #setfacl -m d:andy:rwx test/
  #getfacl test/
  # file: test/
  # owner: root
  # group: root
  user::rwx
  user:andy:rwx
  group::r-x
  mask::rwx
  other::r-x
  default:user::rwx
  default:user:andy:rwx
  default:group::r-x
  default:mask::rwx
  default:other::r-x
  #touch test/aclFile{1..3}
  #ls -l test/
  total 0
  -rw-rw-r--+ 1 root root 0 Mar 28 14:26 aclFile1
  -rw-rw-r--+ 1 root root 0 Mar 28 14:26 aclFile2
  -rw-rw-r--+ 1 root root 0 Mar 28 14:26 aclFile3
  -rw-r--r--  1 root root 0 Mar 28 14:20 file1
  -rw-r--r--  1 root root 0 Mar 28 14:20 file2
  -rw-r--r--  1 root root 0 Mar 28 14:20 file3
  aclFile1~3 有+表示有繼承

有三個群組分別是students,teachers,shareUsers共同對此目錄/mnt/projects分別有不同權限;root為此目錄擁有者;student是有效群組,並且有讀寫創建新檔案 ;teachers群組能夠有讀寫存取新檔;shareUsers群組只有讀取檔案權限。不包含students,teachers,shareUsers群組的其他人(Outher)無法存取此目錄。

• 事前先建立群組及使用者

  #groupadd teachers
  #groupadd shareUsers
  #groupadd students
  #useradd -G teachers joe
  #useradd -G students andy
  #useradd -G shareUsers laua
  #useradd tea (當其他人)
  #cat /etc/group|grep -E '(students|teachers|shareUsers)'
  
  teachers:x:512:joe
  shareUsers:x:513:laua
  students:x:514:andy

• 結果狀態

  #ls -ld /mnt/projects/
  drwxrws---+ 3 root students 4096 Mar 29 10:23 /mnt/projects/
  #ll /mnt/projects/
  drwxrws---+ 2 andy students 4096 Mar 29 10:44 rootD1
  -rw-rw----+ 1 root students    0 Mar 29 10:40 rootF1
  drwxrws---+ 2 andy students 4096 Mar 29 10:43 studentD1
  -rw-rw----+ 1 andy students    0 Mar 29 10:43 studentF1
  drwxrws---+ 2 joe  students 4096 Mar 29 10:26 teacherD1
  -rw-rw----+ 1 joe  students   19 Mar 29 10:21 teacherF1

開始設定ACL

#chgrp students /mnt/projects/
#chmod 2770 /mnt/projects/
#setfacl -m g:teachers:rwx /mnt/projects/
#setfacl -m g:shareUsers:rx /mnt/projects/
#setfacl -m d:g:teachers:rwx /mnt/projects/
#setfacl -m d:g:shareUsers:r /mnt/projects/
#getfacl /mnt/projects/
 
# file: mnt/projects/
# owner: root
# group: students
# flags: -s-
user::rwx
group::rwx
group:teachers:rwx
group:shareUsers:r-x
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:teachers:rwx
default:group:shareUsers:r--
default:mask::rwx
default:other::---

開始測試ACL

#cat /etc/group|grep -E '(students|teachers|shareUsers)'
teachers:x:512:joe
shareUsers:x:513:laua
students:x:514:andy
 
[tea@Main mnt]$cd /mnt/projects/
bash: cd: /mnt/projects/: Permission denied
============================================
[laua@Main mnt]$cd /mnt/projects/
[laua@Main projects]$ls -l
drwxrws---+ 2 andy students 4096 Mar 29 10:44 rootD1
-rw-rw----+ 1 root students    0 Mar 29 10:40 rootF1
drwxrws---+ 2 andy students 4096 Mar 29 10:43 studentD1
-rw-rw----+ 1 andy students    0 Mar 29 10:43 studentF1
drwxrws---+ 2 joe  students 4096 Mar 29 10:26 teacherD1
-rw-rw----+ 1 joe  students   19 Mar 29 10:21 teacherF1
[laua@Main projects]$cat teacherF1
My name is teacher
[laua@Main projects]$ echo "hello" >>teacherF1
bash: teacherF1: Permission denied
[laua@Main projects]$ls teacherD1/
 ls: cannot access teacherD1/F1: Permission denied
============================================
[andy@Main mnt]$cd /mnt/projects/
[andy@Main projects]$touch studentF2;ls -l
drwxrws---+ 2 andy students 4096 Mar 29 10:44 rootD1
-rw-rw----+ 1 root students    0 Mar 29 10:40 rootF1
drwxrws---+ 2 andy students 4096 Mar 29 10:43 studentD1
-rw-rw----+ 1 andy students    0 Mar 29 10:43 studentF1
-rw-rw----+ 1 andy students    0 Mar 29 11:13 studentF2
drwxrws---+ 2 joe  students 4096 Mar 29 10:26 teacherD1
-rw-rw----+ 1 joe  students   19 Mar 29 10:21 teacherF1
============================================
[joe@Main mnt]$ cd projects/
[joe@Main projects]$touch teacherF2;ls -l
drwxrws---+ 2 andy students 4096 Mar 29 10:44 rootD1
-rw-rw----+ 1 root students    0 Mar 29 10:40 rootF1
drwxrws---+ 2 andy students 4096 Mar 29 10:43 studentD1
-rw-rw----+ 1 andy students    0 Mar 29 10:43 studentF1
-rw-rw----+ 1 andy students    0 Mar 29 11:13 studentF2
drwxrws---+ 2 joe  students 4096 Mar 29 10:26 teacherD1
-rw-rw----+ 1 joe  students   19 Mar 29 10:21 teacherF1
-rw-rw----+ 1 joe  students    0 Mar 29 11:16 teacherF2
[joe@Main projects]$rm -f studentF2;ls -l