In the users section we saw how to make a user a member of a set of groups. In order to control access to things, we specify which groups have access to a particular thing. If the user is a member of any of the specified groups, access is permitted.
say we have a users file entry:
bob xxYeIExOhgQJU Top gibber jabberbob now belongs to both the 'gibber' and 'jabber' groups.
Group "Foo" {
acl_foobar: jabber gizzle
...
}
this gives all members of the groups 'jibber' and 'gizzle'
foobar permission. Thus, the user bob, being a member of 'jabber',
has foobar access.
You can specify access control parameters on an object in either of 2 modes: simple or extended.
In simple mode, there are 3 access control lists which control all permissions:
Note, these are separate acls, controlling access to different things. Argus will happily permit a user access to debugging info (acl_root) and deny them access to view the webpage (acl_user). If you want to permit a user access to everything, they will need to be in all 3 of the acls.
By default, if no acls are specified in the config file, argus uses 3 groups named 'user', 'staff', and 'root' and creates acls:
acl_root: root acl_staff: staff root acl_user: user staff rootallowing you to assign one of these 3 groups to users in the users file
In extended mode, each separate function has its own acl.
Group "Foo" {
acl_mode: extended
acl_override: staff
acl_getconf: sr_staff
...
}
The acls are:ACLs are cumulative from the top level down.
Group "Foo" {
acl_override: foo
Group "Bar" {
acl_override: bar
...
}
}
Members of both groups 'foo' and 'bar' will have override access
on 'Bar'.
The syntax '-group' can be used to remove groups. The special '-ALL' will remove all groups:
Group "Foo" {
acl_override: foo bar
Group "Bar" {
acl_override: -foo baz
...
}
Group "Baz" {
acl_override: -ALL baz
...
}
}