Linux Access Control

Hello,
I have been stuck to this Linux ACL problem for more than 24 hr. I have used “Chmod” for the 2 first two questions and “ACL” commands for question 3 and 4. Can anyone please help me.

Thanks in advance

This isn’t about chmod. That sets simple permissions only. The clue here is ACL. You need to use the setfacl command to set granular permissions like that.

I have tried that and it still gave me an error. I have attached screenshots

This is how I’ve tried solving it:

  1. ssh into the server
  2. sudo -i
    3.cd /etc
  3. chown root:root hosts
  4. chmod u +rwx hosts
  5. chmod g +rwx hosts
  6. chmod 0 +r hosts
  7. setfacl -x u:rose hosts
  8. setfacl -m u:garrett:r hosts

Then I got the error attached below:

You are not applying the permissions to the correct file. The question in your screenshot asks you to set on /etc/resolv.conf, not /etc/hosts

When you redo a task in KKE, the requirements for the task (e.g. files, users, hosts etc) change, so you must read the question carefully every time!

indeed the task data changes. I reapply the permissions and still doesn’t work! See screenshot below:

The task passes for me

[root@stapp02 ~]# cd /etc
[root@stapp02 etc]# getfacl hosts
# file: hosts
# owner: root
# group: root
user::rw-
group::r--
other::r--

[root@stapp02 etc]# setfacl -m u:yousuf:000 hosts
[root@stapp02 etc]# setfacl -m u:eric:r hosts 
[root@stapp02 etc]# getfacl hosts
# file: hosts
# owner: root
# group: root
user::rw-
user:yousuf:---
user:eric:r--
group::r--
mask::r--
other::r--

In this attempt

  • There was nothing to do for #1 and #2 as can be seen from the output of the first getfacl
  • #3 and #4 are addressed by the two setfacl commands
1 Like

Also setfacl -x does not deny permission. It removes any ACL for the user specified. That means the user will get the standard permissions as set by chmod which is not what the question asks.

You deny access with a specific deny ACL - that is the first one in my solution above.

1 Like

It worked, thank you much for your help. I was not adding the “000” to remove the permissions…