Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What "beyond POSIX" file permissions are you using in your production/home Linux setups?

I am using SELinux through FC11. Don't really notice it apart from the violations applet in Gnome.

Does anyone use any trusted/permission-required-execution on Linux (Like that of Windows)?

Basically, what is your permissions setup like apart from the usual chmod masks, and what are your experiences with it?!

share|improve this question

I've used Posix ACLs quite often, usually they're quite handy, especially when dealing with restrictive existing permissions (as often happens when trying to do complicated things with control panels such as Plesk).

They're very solid and work surprisingly well, for example if you have a folder with the following permissions:

drwx------  2 root root 4096 2009-07-22 20:51 foo

You can make it readable by the user 'nobody' with ACLs as follows:

[root@server] $ setfacl -m u:nobody:rwx foo/

You'll then see the permissions have been modified to allow this:

[root@server] $ ls -la
drwxrwx---+  2 root root 4096 2009-07-22 20:54 foo
[root@server] $ sudo -u nobody touch foo
[root@server] $
share|improve this answer
+1, Good stuff. This is the kind of usage example I am after. To give a broad view of things – Aiden Bell Jul 22 '09 at 20:19

I use AppArmor on Ubuntu. It's a far handier SE-Linux, since it effectively has a default allow. Most things come with policies. On Ubuntu it's a pain to write policies however.

share|improve this answer
SELinux is very cryptic too! More so than apparmour. I am wondering if there are any "do you want this app to run" setups for Linux beyond crufty integrity systems that are part of IDS setups. – Aiden Bell Jul 22 '09 at 19:09

I'm using Posix ACLs on my school-servers.
So teachers can read/write in any samba project-share. Normally only pupils within a certain group can read/write there.

It's very usefull!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.