In this lesson, you will learn how to architect a directory structure that enforces the Principle of Least Privilege (PoLP) using granular ACLs, ensuring users access only what is strictly necessary for their tasks.
The Strategy: "Deny by Default"
The traditional UGO (User, Group, Others) model is often too blunt for modern workflows. To apply PoLP, we treat the filesystem as a "need-to-know" environment. Instead of relying on broad group memberships—where every member of developers might gain access to marketing files—we use ACLs to bridge the gap by granting targeted permissions to specific users or small, task-oriented groups.
Architecting the Structure
Imagine a corporate structure where a projects/ directory contains folders for different clients. Instead of making these directories globally readable, we remove all "other" access and use ACLs to explicitly define who can enter:
# 1. Start by stripping world access
chmod -R o-rwx /data/projects/client_alpha
# 2. Grant the specific project lead access
setfacl -m u:alice:rwx /data/projects/client_alpha
# 3. Allow read-only access for an auditor without group membership
setfacl -m u:auditor_bob:rx /data/projects/client_alpha
Implementing Inheritance
To keep the structure secure as files are created, we apply Default ACLs. This ensures that any new sub-directory or file automatically inherits the restricted access policy, preventing "privilege creep" where new files are accidentally exposed to the wrong users.
# Set default ACLs for the directory to enforce inheritance
setfacl -d -m u:alice:rwx /data/projects/client_alpha
setfacl -d -m u:auditor_bob:rx /data/projects/client_alpha
By explicitly naming users in the ACLs rather than relying on broad group permissions, you create a "sandbox" effect. If a user leaves a project, you simply remove their specific ACL entry with setfacl -x u:username. This method eliminates the need to shuffle users between complex group structures, keeping your security posture precise and auditable.
Key Takeaway: Architect your directories by removing world access entirely and granting specific, explicit rights via Default ACLs to ensure users only interact with files necessary for their immediate function.