Beyond Linux® From Scratch - Version 7.4

Chapter 4. Security

acl-2.2.52

Introduction to acl

The acl package contains utilities to administer Access Control Lists, which are used to define more fine-grained discretionary access rights for files and directories.

This package is known to build and work properly using an LFS-7.4 platform.

Package Information

acl Dependencies

Required

attr-2.4.47

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/acl

Installation of acl

Install acl by running the following commands: 

sed -i -e 's|/@pkg_name@|&-@pkg_version@|' \
     include/builddefs.in &&

INSTALL_USER=root  \
INSTALL_GROUP=root \
./configure --prefix=/usr --libexecdir=/usr/lib --disable-static &&
make

For meaningful results, the tests need to be carried out on a file system that supports extended attributes. It is also required that Coreutils is re-installed after acl is installed so that the extra acl bit displays correctly on a ls command.

Now, as the root user: 

make install install-dev install-lib             &&
chmod -v 755 /usr/lib/libacl.so                  &&
mv -v /usr/lib/libacl.so.* /lib                  &&
ln -sfv ../../lib/libacl.so.1 /usr/lib/libacl.so &&
install -v -m644 doc/*.txt /usr/share/doc/acl-2.2.52

You should now re-install Coreutils and proceed to run the test suite.

There are three sets of tests that come with this package. The local partition where the tests are run must be mounted with acl configured as described below. Additionally, the users bin and daemon must be created or modified to have a proper shell and home directory and the group daemon must be a member of the bin group. The kernel must also be configured with the appropriate ACL options (there are nine different options).

To run the standard tests run make tests . As root user, run make root-tests.

The third set of tests are Network File System (NFS) specific. See the contents of the test files in the test/nfs/ directory for the setup requirements.

Command Explanations

sed -i ... include/builddefs.in: This command modifies the documentation directory so that it is a versioned directory.

--disable-static: This switch prevents installation of static versions of the libraries.

Configuring acl

Configuration Information

There is no configuration to acl itself, but to get any use out of acl, a filesystem needs to support access control lists.

One way to achieve this is to add the acl option to an ext3 filesystem in the /etc/fstab file as shown below: 

# file system  mount-point  type   options                 dump  fsck
#                                                                order

/dev/sda1      /            ext3   defaults,acl,user_xattr 0     2

Contents

Installed Programs: chacl, getfacl, and setfacl
Installed Library: libacl.{so,a}
Installed Directories: /usr/{include/acl,share/doc/acl-2.2.52}

Short Descriptions

chacl

changes the access control list of a file or directory.

getfacl

gets file access control lists.

setfacl

sets file access control lists.

libacl.{so,a}

contains the acl API functions.

Last updated on 2013-08-22 13:45:41 -0700