File Format¶

The files /usr/share/permissions/permissions.* are line based and whitespace delimited. Lines starting with '#' are comments. A permissions entry consists of lines of the following format:

:package: pkg1[,pkg2...]
/path/to/file user:group 0755


 +capabilities cap_net_admin=ep


 +acl user:somebody:rwx

The main part of an entry is the file path specification as seen in the second line, which consists of three whitespace separated columns:

Basic file entries can be extended by immediately following lines starting with +<keyword>. The following keywords are supported:

+capabilities

+acl

The optional :package: directive allows to restrict following path entries to files owned by the given comma separated list of packages. The designated permissions will then only be assigned to the target file if it is owned by one of the specified packages according to the RPM system database. This setting is in effect for all subsequent permission entries in the file until another :package: directive is encountered. Entries appearing before any :package: line will always be applied without inspecting target file package ownership.

The file name in the first column of the base entry can contain contain variables as defined in the variables.conf file. A variable expands to one or more alternative path segments that relate to the same program or file. permctl will look in each possible path resulting from the variable expansion and apply the permissions accordingly.

Path Variable Expansion via variables.conf¶

The variables.conf file will ignore empty lines, whitespace only lines or comment lines starting with '#'. All other lines must contain variable definitions that follow the syntax 'myvar = /path/1 /path/2'. This example will declare a variable identified as myvar that will expand to both specified path segments.

Path segments appearing in variable assignments need to be separated by whitespace characters. The path values cannot contain whitespace themselves. The variable identifier is limited to alphanumeric characters and the underscore character.

To reference a variable in a permissions file, it needs to be dereferenced using the %{myvar} syntax. The variable needs to appear as a single path component and cannot be mixed with other literal characters. Multiple variables per path are allowed. The following are valid uses of variables:

- %{myvar}/sub/path
- /parent/path/%{myvar}
- /parent/path/%{myvar}/sub/path
- %{var1}/path/%{var2}

While the following are invalid:

- /prefix/pre%{myvar}suf/suffix
- /%{var}text/path
- /path/text%{var}

Configuration File Locations¶

/usr/share/permissions/variables.conf

The permctl program, when run in --system mode, will assemble a set of configuration entries depending on the profiles configured in /etc/sysconfig/security. The order of files parsed (with increasing priority) is as follows:

/usr/share/permissions/permissions

/usr/share/permissions/permissions.<profile>

/usr/share/permissions/packages.d/*

/etc/permissions.local

Available Predefined Profiles¶

The permissions package ships the following predefined profiles:

easy

secure

paranoid