Linux Extended Permissions

Question

What "beyond POSIX" file permissions are you using in your production/home Linux setups?

I am using SELinux through FC11. Don't really notice it apart from the violations applet in Gnome.

Does anyone use any trusted/permission-required-execution on Linux (Like that of Windows)?

Basically, what is your permissions setup like apart from the usual chmod masks, and what are your experiences with it?!

Answer 1

I've used Posix ACLs quite often, usually they're quite handy, especially when dealing with restrictive existing permissions (as often happens when trying to do complicated things with control panels such as Plesk).

They're very solid and work surprisingly well, for example if you have a folder with the following permissions:

drwx------  2 root root 4096 2009-07-22 20:51 foo

You can make it readable by the user 'nobody' with ACLs as follows:

[root@server] $ setfacl -m u:nobody:rwx foo/

You'll then see the permissions have been modified to allow this:

[root@server] $ ls -la
...snip...
drwxrwx---+  2 root root 4096 2009-07-22 20:54 foo
[root@server] $ sudo -u nobody touch foo
[root@server] $

Answer 2

I use AppArmor on Ubuntu. It's a far handier SE-Linux, since it effectively has a default allow. Most things come with policies. On Ubuntu it's a pain to write policies however.

Answer 3

I'm using Posix ACLs on my school-servers.
So teachers can read/write in any samba project-share. Normally only pupils within a certain group can read/write there.

It's very usefull!