getfacl (獲取文件訪問控制列表)

舞夕之發(fā)表于 2020-07-16 15:45

瀏覽次數(shù)：

命令行 Unix&Linux命令 getfacl

在手機上閱讀

釋放雙眼，帶上耳機，聽聽看~！

00:00

在類Unix操作系統(tǒng)上，getfacl命令獲取文件訪問控制列表。文檔介紹了getfacl的Linux版本。

查看英文版

1 getfacl 運行系統(tǒng)環(huán)境

2 getfacl 描述

3 getfacl 語法

4 getfacl 示例

getfacl 運行系統(tǒng)環(huán)境

Unix&Linux

getfacl 描述

對于每個文件，getfacl顯示文件名、所有者、組和訪問控制列表（ACL）。如果目錄具有默認ACL，則getfacl還會顯示默認ACL。非目錄不能具有默認ACL。
如果getfacl用于不支持acl的文件系統(tǒng)，getfacl將顯示由傳統(tǒng)文件模式權(quán)限位定義的訪問權(quán)限。
getfacl的輸出格式如下：

1:  # file: somedir/
2:  # owner: lisa
3:  # group: staff
4:  user::rwx
5:  user:joe:rwx               #effective:r-x
6:  group::rwx                 #effective:r-x
7:  group:cool:r-x
8:  mask:r-x
9:  other:r-x
10:  default:user::rwx
11:  default:user:joe:rwx       #effective:r-x
12:  default:group::r-x
13:  default:mask:r-x
14:  default:other:---

第4、6和9行對應(yīng)于文件模式權(quán)限位的用戶、組和其他字段。這三個被稱為基本ACL條目。第5行和第7行是命名用戶和命名組條目。第8行是有效的權(quán)利面具。授予所有指定用戶的有效權(quán)限。（文件所有者和其他權(quán)限不受有效權(quán)限掩碼的影響；所有其他條目都受此影響。）第10行到第14行顯示與此目錄關(guān)聯(lián)的默認ACL。目錄可能具有默認ACL。常規(guī)文件從來沒有默認的ACL。
getfacl的默認行為是同時顯示ACL和默認ACL，并為條目的權(quán)限與有效權(quán)限不同的行包含有效權(quán)限注釋。
如果輸出到終端，則有效權(quán)限注釋與第40列對齊。否則，只有一個制表符分隔ACL條目和有效權(quán)限注釋。
多個文件的ACL列表用空行分隔。getfacl的輸出也可以用作setfacl的輸入。
權(quán)限
對文件具有搜索訪問權(quán)限的進程（即對文件的包含目錄具有讀取權(quán)限的進程）也被授予對文件ACL的讀取訪問權(quán)限。這類似于訪問文件模式所需的權(quán)限。

For each file, getfacl displays the file name, owner, the group, and the Access Control List (ACL). If a directory has a default ACL, getfacl also displays the default ACL. Non-directories cannot have default ACLs.

If getfacl is used on a file system that does not support ACLs, getfacldisplays the access permissions defined by the traditional file mode permission bits.

The output format of getfacl is as follows:

1:  # file: somedir/
2:  # owner: lisa
3:  # group: staff
4:  user::rwx
5:  user:joe:rwx               #effective:r-x
6:  group::rwx                 #effective:r-x
7:  group:cool:r-x
8:  mask:r-x
9:  other:r-x
10:  default:user::rwx
11:  default:user:joe:rwx       #effective:r-x
12:  default:group::r-x
13:  default:mask:r-x
14:  default:other:---

Lines 4, 6 and 9 correspond to the user, group and other fields of the file mode permission bits. These three are called the base ACL entries. Lines 5 and 7 are named user and named group entries. Line 8 is the effective rights mask. This entry limits the effective rights granted to all groups and to named users. (The file owner and others permissions are not affected by the effective rights mask; all other entries are.) Lines 10through 14 display the default ACL associated with this directory. Directories may have a default ACL. Regular files never have a default ACL.

The default behavior for getfacl is to display both the ACL and the default ACL, and to include an effective rights comment for lines where the rights of the entry differ from the effective rights.

If output is to a terminal, the effective rights comment is aligned to column 40. Otherwise, a single tab character separates the ACL entry and the effective rights comment.

The ACL listings of multiple files are separated by blank lines. The output of getfacl can also be used as input to setfacl.

Permissions

Processes with search access to a file (i.e., processes with read access to the containing directory of a file) are also granted read access to the file's ACLs. This is analogous to the permissions required for accessing the file mode.

查看英文版

getfacl 語法

getfacl [-dRLPvh] file ...

getfacl [-dRLPvh] -

選項

--access	顯示文件訪問控制列表。
-d, --default	顯示默認訪問控制列表。
--omit-header	不顯示注釋標題(每個文件輸出的前三行)。
--all-effective	打印所有有效的權(quán)限注釋，即使與ACL條目定義的權(quán)限相同。
--no-effective	不打印生效的權(quán)限注釋。
--skip-base	跳過僅具有基本ACL條目(所有者、組、其他)的文件。
-R, --recursive	遞歸列出所有文件和目錄的ACL。
-L, --logical	“Logical walk”(跟隨符號鏈接)。默認行為是跟隨符號鏈接參數(shù)，并跳過在子目錄中遇到的符號鏈接。
-P, --physical	“Physical walk”(跳過所有符號鏈接)。這還會跳過符號鏈接參數(shù)。
--tabular	使用另一種表格輸出格式。ACL和默認ACL并排顯示。由于ACL掩碼項而無效的權(quán)限將以大寫形式顯示。ACL_USER_OBJ和ACL_GROUP_OBJ條目的條目標記名稱也以大寫字母顯示，這有助于識別這些條目。
--absolute-names	不要去掉前導斜杠字符（“/”）。默認行為是去掉前導斜杠字符。
--version	打印getfacl版本并退出。
--help	打印說明命令行選項的幫助。
--	命令行選項的末尾。所有其余參數(shù)都被解釋為文件名，即使它們以破折號字符開頭也是如此。
-	如果文件名參數(shù)是單個短劃線字符，則getfacl從標準輸入讀取文件列表。

環(huán)境變量

如果定義了環(huán)境變量POSIXLY_CORRECT，getfacl的默認行為將以以下方式更改：除非另有指定，否則只打印ACL。只有在給定-d選項時才會打印默認ACL。如果沒有給出命令行參數(shù)，getfaclbehave就好像它被調(diào)用為“getfacl-”。

getfacl [-dRLPvh] file ...

getfacl [-dRLPvh] -

Options

--access	Display the file access control list.
-d, --default	Display the default access control list.
--omit-header	Do not display the comment header (the first three lines of each file's output).
--all-effective	Print all effective rights comments, even if identical to the rights defined by the ACL entry.
--no-effective	Do not print effective rights comments.
--skip-base	Skip files that only have the base ACL entries (owner, group, others).
-R, --recursive	List the ACLs of all files and directories recursively.
-L, --logical	"Logical walk" (follow symbolic links). The default behavior is to follow symbolic link arguments, and to skip symbolic links encountered in subdirectories.
-P, --physical	"Physical walk" (skip all symbolic links). This also skips symbolic link arguments.
--tabular	Use an alternative tabular output format. The ACL and the default ACL are displayed side by side. Permissions that are ineffective due to the ACL mask entry are displayed capitalized. The entry tag names for the ACL_USER_OBJ and ACL_GROUP_OBJ entries are also displayed in capital letters, which helps in spotting those entries.
--absolute-names	Do not strip leading slash characters (‘/’). The default behavior is to strip leading slash characters.
--version	Print the version of getfacl and exit.
--help	Print help explaining the command line options.
--	End of command line options. All remaining parameters are interpreted as file names, even if they start with a dash character.
-	If the file name parameter is a single dash character, getfacl reads a list of files from standard input.

查看英文版

getfacl 示例

getfacl myfile.txt

顯示文件myfile.txt的訪問控制列表。輸出類似于以下內(nèi)容：

# file: myfile.txt
# owner: computerhope
# group: users
user::rw-
group::r--
other::r--

getfacl myfile.txt

Displays the access control list for the file myfile.txt. Output resembles the following:

# file: myfile.txt
# owner: computerhope
# group: users
user::rw-
group::r--
other::r--

查看英文版

其他命令行

如此好文，分享給朋友