1First support for POSIX ACLs with help from Andreas Gruenbacher <ag@bestbits.at> 2First support for Solaris ACLs (converted into POSIX strings). 3 4ACL status for several OS: 5 6SunOS-4.x No ACL support in the kernel 7 8SunOS-5.x ACL Support was officially added with Solaris-2.5 9 Solaris ACL's are smilar enough to POSIX ACL's so I convert 10 them to POSIX ACLs before archiving them. 11 12 Read the man pages: getfacl, setfacl, acl 13 14 Due to a bug in libsec in function aclfromtext(), 15 restoring ACLs correctly only works if the full passwd access 16 for all users is present during star -x 17 So due to this bug, it is impossible to do ACL backup/restores 18 on passwd-less file servers. 19 20 **** Solaris BUG *** 21 22 As the function aclfromtext() on Solaris is unable to 23 recognise a numerical (all digit) user id, it is not possible 24 to do ACL backup/restore on a Solaris fileserver that has no 25 access to the same passwd data as it's NFS clients. 26 27 Even worse, aclfromtext() changes the UID for each unknown 28 user to NOBODY and the function aclfromtext() returns as if 29 there was no error. This is a serious security problem as 30 because if this behavior the file becomes (in addition to the 31 other users in the ACL) accessible by "nobody" which 32 definitely is intended. 33 34 This is Sun bug 4426407 ;-) 35 36 If Sun would make libsec true Open Source, it would be easy 37 to fix this bug in less than 10 minutes. 38 39 **** Solaris BUG *** 40 41Linux ACL support available as Patch for Linux-2.4 and 42 Linux-2.2.20. 43 44 You need to install the Linux ACL patch _before_ 45 compiling star. 46 47 By default Linux does not yet support ACLs. To 48 install ACL support get the patch from: 49 50 http://acl.bestbits.at/ 51 52 This page also lists the man pages for the ACL support 53 commands for Linux. 54 55FreeBSD FreeBSD-5.0 supports ACLs, but they need to be activated. 56 You need to know that you need to activate ACLs in the 57 kernel _and_ in each filesystem that should carry ACLs. 58 59True64 If you are on True64, you first need to activate extended 60 security features in order to use ACLs. 61 The administratice command names to list or set ACLs are 62 'getacl' and 'setacl'. 63 64 **** First tests on True64 show that the POSIX.1e function 65 **** acl_from_text() does not work as expected. I have no 66 **** idea how to work around this problem. 67 **** It may be that True64 does not support the ACL 'masks' 68 **** *entry. This would force us to create syntetic 'mask' 69 **** entries when in star create mode and to compute the 70 **** effective mode when in extract mode. On True64 also the 71 **** function acl_get_file() does not work properly if a file 72 **** does not have ACLs. Note that the standard requests that 73 **** in this case acl_get_file() should return a 3 entry ACL, 74 **** but on True64 it returns NULL with 'errno' unchanged. 75 **** Archiving and restoring ACLs from/to True64 will most 76 **** likely work. If you like to transfer TAR archives from/to 77 **** other platforms you will not be able to restore any ACL. 78 **** 79 **** As a TAR archive with ACLs made on True64 is not usable on 80 **** any other system, ACL support on True64 could be called 81 **** broken. 82 83 84HP-UX HP-UX ACLs are so different from POSIX.1e that it would take a 85 significant amount of time to code a translation module for 86 star. For this reason, HP-UX is currently not yet not supported. 87 88AIX AIX ACLs are so different from POSIX.1e that it would take a 89 significant amount of time to code a translation module for 90 star. For this reason, HP-UX is not supported at the moment. 91 92IRIX Unknown state, please report 93 94SCO/Caldera UnixWare/OpenUnix seem to be very similar to Solaris in low 95 level but there is no high level (ACL string) support, so 96 we cannot support SCO unless Sun makes the source of the 97 libsec open. 98 99 100/*--------------------------------------------------------------------------*/ 101If you list a TAR archive that contains ACLs for certain files, 102those files are marked with a '+' sign past the UNIX permissions 103if you request a long listing: 104 105 0 -rw-r--r-- gruenbacher/assis Nov 4 04:43 2001 default/file 106 0 drwxrwxr-x+ gruenbacher/assis Nov 4 04:43 2001 default/dir2/ 107 0 drwxr-xr-x+ gruenbacher/assis Nov 4 04:44 2001 default/dir3/ 108 0 drwxrwxr-x+ gruenbacher/assis Nov 4 04:44 2001 default/ 109 110If you like ACL test tar archives, have a look at: 111 112 http://acl.bestbits.at/pre/ 113 114and fetch the files acl*.tar 115 116Note: The ACL support code in star is alpha! Do not expect it to be 117stable in any part. I cannot even grant that the archive format 118will not change. However, if it turns out to be the right solution, I 119will mail the star ACL format to the POSIX.1e standard committee. 120All changes have been made in a way that does not affec the behaviour 121of star in case no ACLs are present. 122 123The format for ACLs in the extended headers used by star looks like: 124 125SCHILY.acl.access = user::rwx,user:lisa:r-x:502,group::r-x, \ 126 group:toolies:rwx:102,mask::rwx,other::r-x 127 128SCHILY.acl.default = user::rwx,user:lisa:r-x:502,group::r-x, \ 129 mask::r-x,other::r-x 130 131The text above has been broken into shorter lines for readability 132 133This is a legal 'vendor unique' POSIX.1-2001 extension for extended 134tar headers. 135 136If the format gets accepted by the POSIX.1 and POSIX1e committee, it 137would look like: 138 139security.acl...=user::rwx,group::rwx,mask::rwx,other::rwx,.... 140 141As the text format specified by POSIX.1e is not sufficient for TAR, we 142added a numerical field for all names user and group fields. 143 144POSIX.1e named user entry: 'user:joe:rwx,' 145STAR named user entry: 'user:joe:rwx:1431,' 146 147When star extracts the ACL string, it first checks if user 'joe' is 148known if 'joe' is known, the numerical value is stripped off and a 149standard POSIX.1e ACL entry is created. If 'joe' is not known, the 150text 'joe' is replaced by the numerical value '1431' and a new 151POSIX.1e entry that looks like 'user:1431:rwx,' is created. 152 153/*--------------------------------------------------------------------------*/ 154How to use ACLs with star: 155 156To archive ACLs (star in create mode, you need to specify a TAR format 157that supports extended POSIX.1-2001 headers _and_ uses them by default. 158This may currently be achieved by calling "star -Hexustar ...". 159In addition, you need to specify the -acl option. 160So you need to call "star -Hexustar -acl ...". 161 162To extract ACLs you need to call "star -acl ..." 163 164This option -acl has been introduced because it turns out that it is 165impossible to handle the extract case (when the filesystem does 166not support ACLs) in a decent way. Without -acl star would either 167be forced to suppress eror messages for ACL handling or people 168would see hundreds of ACL warnings. 169 170The intention for the -acl option was to make ACL handling easy 171to understand. 172 173Here is a description how -acl works: 174 175- if -acl is not present in create mode, star does not 176 archive ACLs 177 178- if -acl is present in create mode and the header type 179 is 'exustar' (selected by H=exustar), star will 180 add ACL information to the archive. 181 182- if -acl is not present in extract mode, star does not 183 handle ACL information (i.e. if the FS does not handle 184 ACLs, no error messages will occur, if the FS handles 185 ACLs and there are default ACLs set up for the directory 186 where star puts the extracted files the extracted files 187 will have the inherited ACLs from the Default ACL od the 188 directory regardless of the ACL information in the archive). 189 190- if -acl is present in extract mode, star handles ACLs. 191 If the tar archive does not include ACL information at all 192 or if the archiv does not include ACL information for a 193 specific file, star will clear the ACL for this file. 194 If the tar archive includes ACL information for the file, 195 star will set up the ACL to be the same as the ACL information 196 in the archive (i.e. if -acl is present in extract mode, 197 no ACL information will be inherited from the ACL information 198 that was present in the filesystem tree before the exrtact 199 operation took place). 200 201 If -acl is present in extract mode and the filesystem where 202 the files are extracted to does not support ACLs, star will 203 display an error message fo each file that is extracted. 204