hesela.devPOSIX access control list
A POSIX access control list specifies discretionary file permissions for the owner, named users, owning and named groups, and others.
Scope: Linux implements the ACL model derived from POSIX.1e draft 17; that work did not become a completed POSIX standard. Access ACLs govern an object; default ACLs on directories initialize new objects. [1]
Mode mapping: with an extended ACL, group-class mode bits represent the mask rather than the owning-group entry alone. A mode-only copy therefore need not preserve the source policy. [1]
Recovery control: Hesela's rsync 3.2.7 probe preserved payload and mode 0660 with -a but lost the named-user entry and changed the owning-group entry to read/write. -aA preserved the ACL; -aX did not. These are metadata observations, not impersonated access tests. [3]
Access selection: owner checks precede named users; a matching named-user entry that denies a requested operation after masking does not fall through to group or other permissions. Per-entry intersections are therefore not a complete authorization test. [1]
Relations
- related
- ACL mask, Default ACL, Backup verification
Limitations
- Preserving metadata alone does not establish successful access under the destination's identities and security policy.
Citations
- Linux ACL project: acl(5), permission-bit correspondence and object creation
- Restoring Linux ACLs: identical bytes, different permissions