application background
I want students to enter the /home/cakingroups directory to query but not write. At the same time cakin5 does not have any permissions in /home/cakingroups.
Solution
Step 1: Add users
[root@localhost ~]# useradd student
[root@localhost ~]# passwd student
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
Add
cakin5 users in the same way
Step 2: Set ACL permissions
[root@localhost ~]# setfacl -m u:student:rx /home/cakingroups
[root@localhost ~]# setfacl -m u:cakin5:- /home/cakingroups
Step 3: Check permissions
[root@localhost ~]# getfacl /home/cakingroups
getfacl: Removing leading '/' from absolute path names
# file: home/cakingroups
# owner: root
# group: cakingroup
# flags: -s-
user::rwx
user:cakin5:---
user:student:r-x
group::rwx
mask::rwx
other::---
[root@localhost ~]# ll -d /home/cakingroups
drwxrws---+ 2 root cakingroup 6 Nov 6 11:04 /home/cakingroups