I'm using ACL to control access to individual roots of webs for different instances of Apache and different groups of admins. I've got a Unix group admins-web22 for admins of a particular website and user apache-web22 for a particular instance of apache. These are the permissions set on the root directory of the web:# file: web22# owner: root# group: rootuser::rwxuser:apache-web22:r-xgroup::rwxgroup:webmaster:rwxgroup:admins-web22:rwxmask::rwxother::---default:user::rwxdefault:user:apache-web22:r-xdefault:group::rwxdefault:group:admins-web22:rwxdefault:mask::rwxdefault:other::r-xThere is a user fred which is a member of admins-web22. This user has full read-write access to the directory (as stated above). This works correctly. However, this user is unable to grant write permissions to user apache-web22 for some files and directories, which is important (e.g., the web admin wants to set an upload directory for Drupal). The setfacl command gives Operation not permitted..My question is, who can grant privileges using setfacl, and how can I let users of group admins-web22 change permissions (for apache-web22) themselves? I'm running Debian Wheezy and it's an ext4 partition if it's important.
Who can change ACL permissions?
linux;permissions;acl;privileges
The setfacl manual page explains who can grant privileges:The file owner and processes capable of CAP_FOWNER are granted the right to modify ACLs of a file. This is analogous to the permissions required for accessing the file mode. (On current Linux systems, root is the only user with the CAP_FOWNER capability.)So fred can only use setfacl on files he owns. Depending on your exact security requirements, you may be able to allow members of admins-web22 to run setfacl as apache-web22 (using sudo), which would allow them to change the ACLs on files owned by apache-web22....