You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
43 lines
2.0 KiB
43 lines
2.0 KiB
5 years ago
|
#!/bin/bash -e
|
||
|
|
|
||
|
|
WRITE_USERS=''
|
||
|
|
READ_USERS=''
|
||
|
|
WRITE_GROUPS=''
|
||
|
|
READ_GROUPS=''
|
||
|
|
{% if item.acl.read_users | length > 0 %}
|
||
|
|
for U in '{{ item.acl.read_users | join("' '") }}'; do
|
||
|
|
getent passwd "$U" > /dev/null 2>&1 && READ_USERS=$READ_USERS",u:$U:rX,d:u:$U:rX"
|
||
|
|
done
|
||
|
|
{% endif %}
|
||
|
|
{% if item.acl.write_users | length > 0 %}
|
||
|
|
for U in '{{ item.acl.write_users | join("' '") }}'; do
|
||
|
|
getent passwd "$U" > /dev/null 2>&1 && WRITE_USERS=$WRITE_USERS",u:$U:rwX,d:u:$U:rwX"
|
||
|
|
done
|
||
|
|
{% endif %}
|
||
|
|
{% if item.acl.read_groups | length > 0 %}
|
||
|
|
for G in '{{ item.acl.read_groups | join("' '") }}'; do
|
||
|
|
getent group "$G" > /dev/null 2>&1 && READ_GROUPS=$READ_GROUPS",g:$G:rX,d:g:$G:rX"
|
||
|
|
done
|
||
|
|
{% endif %}
|
||
|
|
{% if item.acl.write_groups | length > 0 %}
|
||
|
|
for G in '{{ item.acl.write_groups | join("' '") }}'; do
|
||
|
|
getent group "$G" > /dev/null 2>&1 && WRITE_GROUPS=$WRITE_GROUPS",g:$G:rwX,d:g:$G:rwX"
|
||
|
|
done
|
||
|
|
{% endif %}
|
||
|
|
|
||
|
|
chmod 770 {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
chmod 700 {{ item.path | default(nas_root_dir + '/meta/' + item.name) }}
|
||
|
|
chown root:root {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
{% if not item.protocols.smb.nt_acl and not item.manual_permissions %}
|
||
|
|
setfacl -R --remove-all --remove-default --physical {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
setfacl -R --remove-all --remove-default --physical {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
setfacl -R --physical -m g::---"$READ_USERS$WRITE_USERS$READ_GROUPS$WRITE_GROUPS" -- {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
{% if item.protocols.rsync.enabled %}
|
||
|
|
setfacl -R --physical -m u:rsync:{{ item.protocols.rsync.read_only | ternary('rX','rwX') }},d:u:rsync:{{ item.protocols.rsync.read_only | ternary('rX','rwX') }} -- {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
{% endif %}
|
||
|
|
{% endif %}
|
||
|
|
setfacl -R -m mask::rwX,d:mask:rwX -- {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
{% if ansible_selinux.status == 'enabled' %}
|
||
|
|
restorecon -R {{ item.path | default(nas_root_dir + '/data/' + item.name) }}
|
||
|
|
{% endif %}
|