我有一个应用程序在/ opt / reports中生成报告文件,其文件在0600拥有root：root.为了允许外部系统自动处理这些报告,我创建了一个具有组’report’的新服务帐户用户,更改了/ opt / reports组用于报告和设置SUIG位,然后在/ opt / reports目录中设置默认ACL,以包含400的报告组和400的掩码.
我注意到,当我手动创建文件时,权限都按预期设置,但是当应用程序创建文件时,默认值不会被继承.
- [root@reports1 ~]# getfacl /opt/reports
- getfacl: Removing leading '/' from absolute path names
- # file: opt/reports
- # owner: root
- # group: report
- user::rwx
- group::r-x
- other::r-x
- [root@reports1 ~]# setfacl -R -d -n -m g:report:r,m::r /opt/reports/
- [root@reports1 ~]# getfacl /opt/reports
- getfacl: Removing leading '/' from absolute path names
- # file: opt/reports
- # owner: root
- # group: report
- user::rwx
- group::r-x
- other::r-x
- default:user::rwx
- default:group::r-x #effective:r--
- default:group:report:r--
- default:mask::r--
- default:other::r-x
手动创建文件似乎工作正常
- [root@reports1 ~]# echo "This is a test file" > /opt/reports/testfile.txt
- [root@reports1 ~]# ls -l /opt/nessus_reports/testfile.txt
- -rw-r--r--+ 1 root report 20 Apr 24 11:16 /opt/reports/testfile.txt
- [root@reports1 ~]# getfacl /opt/reports/testfile.txt
- getfacl: Removing leading '/' from absolute path names
- # file: opt/reports/testfile.txt
- # owner: root
- # group: report
- user::rw-
- group::r-x #effective:r--
- group:report:r--
- mask::r--
- other::r--
- [root@reports1 ~]# ls -l /opt/reports/018b274b-7c21-859d-6295-1af24b14da8451d8fe886e9c192d
- -rw-------+ 1 root report 125952 Apr 24 11:18 /opt/reports/018b274b-7c21-859d-6295-1af24b14da8451d8fe886e9c192d
- [root@reports1 ~]# getfacl /opt/reports/018b274b-7c21-859d-6295-1af24b14da8451d8fe886e9c192d
- getfacl: Removing leading '/' from absolute path names
- # file: opt/reports/018b274b-7c21-859d-6295-1af24b14da8451d8fe886e9c192d
- # owner: root
- # group: report
- user::rw-
- group::r-x #effective:---
- group:report:r-- #effective:---
- mask::---
- other::---
这是预期的行为,我只是误解了所涉及的术语？我错过了某处的旗帜或选项,我是否完全从错误的方向接近它？
