Pros and Cons of ACLs

[xilus]

Does any body know the pros and cons of ACLs
Should I install it and configure it?
It sounds like it is going to configure my groups and users for me, and make a big mess of my /etc/passwd file

am I wrong?

[raghaven.kumar]

ACL or Access Control List is used to set more of permissions on a file or folder.
It is, ofcourse useful, provided you are well versed on setting the permissions using setfacl.
Advantages

[Rubberman]

On Linux, ACL's are part of the SELinux extensions. They can be very useful for sensitive systems with a lot of "curious" users running on them in order to keep things sane. Hoever, configuring SELinux properly is not simple and there are several levels of security you can set it to, depending upon your needs. Read the documentation before you start.

Also, in case you're curious, SELinux was a collaboration between the United States National Security Agency (NSA), Network Associates, Secure Computing Corporation, Trusted Computer Solutions, and Tresys.

From NSA Security-enhanced Linux Team:

"NSA Security-enhanced Linux is a set of patches to the Linux kernel and some utilities to incorporate a strong, flexible mandatory access control (MAC) architecture into the major subsystems of the kernel. It provides an enhanced mechanism to enforce the separation of information based on confidentiality and integrity requirements, which allows threats of tampering and bypassing of application security mechanisms to be addressed and enables the confinement of damage that can be caused by malicious or flawed applications. It includes a set of sample security policy configuration files designed to meet common, general-purpose security goals."

[xilus]

thanks for the information.

Are ACLs a replacement for regular linux permissions?
Or just an enhancement to regular linux permissions?

[Rubberman]

thanks for the information.

Are ACLs a replacement for regular linux permissions?
Or just an enhancement to regular linux permissions?

Yes.
Both, actually. Consider regular file permissions to be a subset of ACLs.