ACLs, Quotas & Limits
Nine rwx bits stop being enough: name one user with setfacl, cap disk use with quotas, cap processes with ulimit, and enforce it all with cgroups.
An interactive Linux lesson: 22 steps, about 30 minutes, on a live simulation in your browser.
The shop keeps its price list in /srv/uploads, a directory the deployers share: drwxrws--- root web, and prices.csv is -rw-rw---- root web. You and bob are in web. carol from the data team is not, and her cat proves it: Permission denied.
Three fixes suggest themselves and two are wrong. Adding carol to web also hands her deploys and restarts, which is not her job. Opening the file to other with o+rw hands it to every account on the box, including a compromised one. The third fix names one person and changes nothing for anyone else.
What you will learn
One writer outside the group
- carol owns the data, not the rights: When one person needs access that matches no group, name the person. That is what an ACL entry is for.
- Reading a getfacl printout: getfacl prints the owner, group and other triplets first, then one line per named user or group. A + after the mode means named entries exist.
- setfacl -m names carol: setfacl -m adds or updates one entry. The person named gets exactly those permissions; nobody else's change.
The mask moves under you
- The mask is a ceiling: The mask caps the named entries and the owning group together. ls -l shows the mask in the group triplet; getfacl shows each entry.
- chmod meets the mask: chmod and the mask share the group triplet. chmod g-w sets the mask; it does not delete entries.
- Break it: the mask narrows
- Taking entries back off: setfacl -x deletes one entry; setfacl -b deletes the whole ACL, and the + goes away with it.
New files inherit the rule
- Every new file needs it too: An ACL lives on the file it protects. A default ACL lives on a directory and is inherited by everything created inside it.
- What does the new file give?: In a default entry, capital X means execute for directories, not for new regular files.
- Drill: a default entry for carol
dave fills the disk
- Quotas are off until you ask: Quotas are off until you ask: the filesystem mounts without them, and the kernel says so at boot.
- Two numbers and a clock: A quota is two numbers and a clock: soft warns and starts grace, hard refuses, grace is how long soft may be exceeded.
- Over soft, under hard: Over soft and under hard, writes succeed with a warning while grace runs. Past grace, soft behaves like hard.
- Break it: the disk is full
- Full disk or full quota?: For a failed write: df first for the disk, quota second for the user. Full disk refuses everyone; quota refuses one user.
bob forks himself
- Too many open files: ulimit caps what one process may hold: open files, child processes, and more. Children inherit the limits from the shell.
- What stops the fork bomb?: RLIMIT_NPROC caps fork: past it, fork fails and the machine survives. That is the whole point.
- Drill: read the hard limit
- Limits die with the shell: ulimit lasts until the shell exits. For every login, write it in limits.conf and it applies at the next login.
The modern answer
- cgroups: limits that stick: ulimit asks each process to behave; a cgroup makes the whole subtree behave. New processes cannot escape their cgroup.
Recap & playground
- Cheat sheet
- Playground