diff --git a/bin/admin/check-consistency.pl b/bin/admin/check-consistency.pl index fd3a6fd..efa1184 100755 --- a/bin/admin/check-consistency.pl +++ b/bin/admin/check-consistency.pl @@ -298,9 +298,10 @@ foreach my $file (@keyhomesfound) { check_file_rights( "/home/$file", [ - "# file: /home/$file", "# owner: $file", "# group: $file", "user::rwx", - "group::r-x", "group:osh-whoHasAccessTo:--x", "group:osh-auditor:--x", "group:$file-aclkeeper:--x", - "group:$file-gatekeeper:--x", "group:$file-owner:--x", "mask::r-x", "other::---", + "# file: /home/$file", "# owner: $file", "# group: $file", "user::rwx", + "group::r-x", "group:osh-whoHasAccessTo:--x", "group:osh-auditor:--x", "group:osh-superowner:--x", + "group:$file-aclkeeper:--x", "group:$file-gatekeeper:--x", "group:$file-owner:--x", "mask::r-x", + "other::---", ], "drwxr-x--x", $file, $file diff --git a/bin/admin/install b/bin/admin/install index e1b0217..4accc3e 100755 --- a/bin/admin/install +++ b/bin/admin/install @@ -843,6 +843,7 @@ if [ "$nothing" = 0 ]; then if [ "$OS_FAMILY" = "Linux" ] || [ "$OS_FAMILY" = "FreeBSD" ]; then setfacl -m "group:osh-whoHasAccessTo:--x" "/home/$grp" setfacl -m "group:osh-auditor:--x" "/home/$grp" + setfacl -m "group:osh-superowner:--x" "/home/$grp" setfacl -m "group:$grp-gatekeeper:--x" "/home/$grp" setfacl -m "group:$grp-aclkeeper:--x" "/home/$grp" setfacl -m "group:$grp-owner:--x" "/home/$grp" diff --git a/bin/helper/osh-groupCreate b/bin/helper/osh-groupCreate index 5b5bf20..17eb2cc 100755 --- a/bin/helper/osh-groupCreate +++ b/bin/helper/osh-groupCreate @@ -190,7 +190,7 @@ foreach my $command ( } chmod 0751, "/home/$group" if !OVH::Bastion::has_acls(); -foreach my $gr ("$group-owner", "$group-gatekeeper", "$group-aclkeeper", "osh-whoHasAccessTo", "osh-auditor") { +foreach my $gr ("$group-owner", "$group-gatekeeper", "$group-aclkeeper", "osh-whoHasAccessTo", "osh-auditor", "osh-superowner") { OVH::Bastion::sys_setfacl(target => "/home/$group", perms => "g:$gr:x") or HEXIT('ERR_SETFACL_FAILED', msg => "Error setting ACLs on group homedir"); }