Specifications
Always Propagate Permissions
Inheritance is a powerful feature, so take advantage of it. By propagating permissions
down a folder hierarchy, you save yourself the time and eort required to manually
assign permissions to descendants.
Use the Eective Permission Inspector
Frequently use the Eective Permission Inspector to make sure users have the correct
access to important resources. This is especially important after changing ACLs.
Sometimes, you might inadvertently give someone more or fewer permissions than
needed. The inspector helps you detect these cases.
For more information about the inspector, see “Determining a User’s File or Folder
Permissions” on page 56.
Protect Applications from Being Modied
If you are sharing applications, make sure you set permissions for applications so that
no one, except a trusted few, can change them. This is a vulnerability that attackers can
exploit to introduce viruses or Trojan horses in your environment.
Keep It Simple
You can unnecessarily complicate le access management if you’re not careful. Keep it
simple. If standard POSIX permissions do the job, use those, but if you must use ACLs,
avoid customizing permissions unless you need to.
Also, use simple folder hierarchies when feasible. A little strategic planning can help
you create eective and manageable shared hierarchies.
Common Folder Congurations
When sharing les and folders between computers, you can set custom permissions
to grant or restrict access to those les and folders.
Before you begin setting custom le and folder permissions, you might want to
investigate how the le and folder will be shared, who has access, and what type
of access you want users to have. A recommended way to manage le and folder
permissions is to create groups of users who share the same privileges.
Depending on your network environment you can use either POSIX, ACL, or both
to manage le or folder access.
The following table shows examples of the POSIX permissions and the ACL
permissions necessary to congure some common folder sharing settings.
28 Chapter 2 Setting Up File Service Permissions