定义默认ACL控制策略

 步骤

实现此案例需要按照如下步骤进行。
步骤一：为目录 /public/ 设置ACL策略，使用户gelin01具有rwx权限

命令操作如下所示：

[root@localhost ~]# id gelin01           //测试是否有gelin01用户
uid=501(gelin01) gid=501(gelin01) 组=501(gelin01),502(tarena)
[root@localhost ~]# mkdir /public        //创建目录
[root@localhost ~]# getfacl /public      //查看ACL策略
getfacl: Removing leading '/' from absolute path names
# file: public/
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

[root@localhost ~]# setfacl -m u:gelin01:rwx /public    //设置ACL策略
[root@localhost ~]# getfacl /public                       //查看ACL策略
getfacl: Removing leading '/' from absolute path names
# file: public/
# owner: root
# group: root
user::rwx
user:gelin01:rwx
group::r-x
mask::rwx
other::r-x

步骤二：在 /public/ 下创建子目录gdir1、文件gfile1，分别查看其ACL策略

命令操作如下所示：

[root@localhost ~]# mkdir /public/gdir1
[root@localhost ~]# touch /public/gfile1
[root@localhost ~]# getfacl /public/gdir1/
getfacl: Removing leading '/' from absolute path names
# file: public/gdir1/
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

[root@localhost ~]# getfacl /public/gfile1 
getfacl: Removing leading '/' from absolute path names
# file: public/gfile1
# owner: root
# group: root
user::rw-
group::r--
other::r--

[root@localhost ~]#

步骤三：为目录 /public/ 设置可继承权限为“用户ht02具有rwx权限”

命令操作如下所示：
[root@localhost ~]# id ht02 //查看ht02用户是否存在
id: ht02：无此用户

[root@localhost ~]# useradd ht02   //创建ht02用户
[root@localhost ~]# getfacl /public/
getfacl: Removing leading '/' from absolute path names
# file: public/
# owner: root
# group: root
user::rwx
user:gelin01:rwx
group::r-x
mask::rwx
other::r-x
[root@localhost ~]# setfacl -dm u:ht02:rwx /public    //设置默认可继承ACL权限
[root@localhost ~]# getfacl /public/
getfacl: Removing leading '/' from absolute path names
# file: public/
# owner: root
# group: root
user::rwx
user:gelin01:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:ht02:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

[root@localhost ~]#

步骤四：在 /public/ 下创建子目录gdir2、文件gfile2，分别查看其ACL策略

命令操作如下所示：

[root@localhost ~]# mkdir /public/gdir2
[root@localhost ~]# touch /public/gfile2
[root@localhost ~]# getfacl /public/gdir2
getfacl: Removing leading '/' from absolute path names
# file: public/gdir2
# owner: root
# group: root
user::rwx
user:ht02:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:ht02:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

[root@localhost ~]# getfacl /public/gfile2
getfacl: Removing leading '/' from absolute path names
# file: public/gfile2
# owner: root
# group: root
user::rw-
user:ht02:rwx                   #effective:rw-
group::r-x                      #effective:r--
mask::rw-
other::r--

步骤五：以用户ht02登入，测试

切换目录身份，命令操作如下所示：

[root@localhost ~]# su - ht02
[ht02@localhost ~]$
对/public/目录是否有写入权限，命令操作如下所示：
[ht02@localhost ~]$ mkdir /public/htdir
mkdir: 无法创建目录"/public/htdir": 权限不够
[ht02@localhost ~]$ getfacl /public/
getfacl: Removing leading '/' from absolute path names
# file: public/
# owner: root
# group: root
user::rwx
user:gelin01:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:ht02:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

[ht02@localhost ~]$
分析： 从这可以看出默认权限对目录本身没有生效，对子目录才开始继承生效。
对/public/下的gdir2和gfile2是否有写入权限，命令操作如下所示：
[ht02@localhost ~]$ mkdir /public/gdir2/htdir
[ht02@localhost ~]$ getfacl /public/gdir2/
getfacl: Removing leading '/' from absolute path names
# file: public/gdir2/
# owner: root
# group: root
user::rwx
user:ht02:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:ht02:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

[ht02@localhost ~]$ ls -ld /public/gdir2/htdir/      //创建成功
drwxrwxr-x+ 2 ht02 ht02 4096 2月  27 16:53 /public/gdir2/htdir/
[ht02@localhost ~]$ getfacl /public/gfile2
getfacl: Removing leading '/' from absolute path names
# file: public/gfile2
# owner: root
# group: root
user::rw-
user:ht02:rwx                   #effective:rw-
group::r-x                      #effective:r--
mask::rw-
other::r--

[ht02@localhost ~]$
[ht02@localhost ~]$ echo 123456 > /public/gfile2     //测试写入
[ht02@localhost ~]$ cat /public/gfile2                
123456
对/public/下的gdir1和gfile1是否有写入权限，命令操作如下所示：
[ht02@localhost ~]$ getfacl /public/gdir1      //可以看到ht02没有呢ACL权限
getfacl: Removing leading '/' from absolute path names
# file: public/gdir1
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

[ht02@localhost ~]$ mkdir /public/gdir1/htdir
mkdir: 无法创建目录"/public/gdir1/htdir": 权限不够
[ht02@localhost ~]$ getfacl /public/gfile1      //可以看到ht02没有呢ACL权限
getfacl: Removing leading '/' from absolute path names
# file: public/gfile1
# owner: root
# group: root
user::rw-
group::r--
other::r--

[ht02@localhost ~]$ echo 123456 > /public/gfile1
-bash: /public/gfile1: 权限不够
[ht02@localhost ~]$