File Format¶

The files /usr/share/permissions/permissions.* are line based and space delimited. Lines starting with '#' are comments. A file entry consists of a line of the format

/path/to/file user:group 0755


 +capabilities cap_net_admin=ep


 +acl user:somebody:rwx

Basic file entries can be extended by immediately following lines starting with +<keyword>. The following keywords are supported:

+capabilities

+acl

The file name in the first column of the base entry can contain contain variables as defined in the variables.conf file. A variable expands to one or more alternative path segments that relate to the same program or file. permctl will look in each possible path resulting from the variable expansion and apply the permissions accordingly.

The variables.conf file will ignore empty lines, whitespace only lines or comment lines starting with '#'. All other lines must contain variable definitions that follow the syntax myvar = /path/1 /path/2. This example will declare a variable identified as myvar that will expand to both specified path segments.

Path segments appearing in variable assignments need to be separated by whitespace characters. The path values cannot contain whitespace themselves. The variable identifier is limited to alphanumeric characters and the underscore character.

To reference a variable in a permissions file, it needs to be dereferenced using the %{myvar} syntax. The variable needs to appear as a single path component and cannot be mixed with other literal characters. Multiple variables per path are allowed. The following are valid uses of variables:

- %{myvar}/sub/path
- /parent/path/%{myvar}
- /parent/path/%{myvar}/sub/path
- %{var1}/path/%{var2}

While the following are invalid:

- /prefix/pre%{myvar}suf/suffix
- /%{var}text/path
- /path/text%{var}

Configuration File Locations¶

The permctl program, when run in --system mode, will assemble a set of configuration entries depending on the profiles configured in /etc/sysconfig/security. The order of files parsed (with increasing priority) is as follows:

/usr/share/permissions/permissions

/usr/share/permissions/permissions.<profile>

/usr/share/permissions/packages.d/*

/etc/permissions.local

Available Predefined Profiles¶

The permissions package ships the following predefines profiles:

easy

secure

paranoid