Theme: 19.71 release

[iliaross]

1. ACLs support in File Manager 🆕
2. Video preview support in File Manager 🆕
3. Password complexity must inherit from Virtualmin configuration when possible ✔️
4. Better SSL warning post-install wizard - ✔️
5. Theme configuration filtered panels must be hidden
6. Add an option to lock encoding set by user and not to run encoding auto-detection or file editor/viewer.

* If there is anything else you would want me to add, improve or fix, please let me know.

[LittleAlf]

The ACL support in File Manager would be really great, since I use ACLs on all important directories of my servers. I do not know how difficult it is to implement it. So, in order to accommodate unforeseen difficulties during the development, it might be possible to split the total development in two parts:

1. Have the possibility to show the ACLs of the selected directory only.
2. Actually modify the ACLs of the selected directory.

In case other more important topics surface during the development of 19.71 release, at least a first step with displaying the ACLs could be accomplished with step 1.

Anyway, many thanks for your work again.

LittleAlf

[iliaross]

Have the possibility to show the ACLs of the selected directory only.

Why selected directory only? Why not make a whole table column with ACL permissions, like we have for Size, Owner, Mode, Modified?

[LittleAlf]

Actually, this is what I meant: Showing a table with all ACL permissions of this directory.

The 'only' was related to that in a first step you would not be able to change them. You could just view them.

But, of course I would love to enter new ACL entries and modify existing ACL entries right in your file manager. Because this would help a lot. Several times already, I was looking at some mistake during copying on the CLI until I found out, that it was related to ACL permissions.

So: If we could get all - I would really love it.

[iliaross]

So: If we could get all - I would really love it.

Yes, we could, I think.

Several times already, I was looking at some mistake during copying on the CLI until I found out, that it was related to ACL permissions.

Could you provide few commands which you personally use to list and modify acls?

[LittleAlf]

Sure, all my thoughts I summarize on your latest message below.

[iliaross]

Okay, listing for ACLs has been implemented:

Give it a look.

You will need to either apply the latest patch from Webmin repo and install latest development version of the theme or run the following command to update to the latest Webmin and Authentic Theme versions all at once:

cd /usr/libexec/webmin
bin/update-devel --product webmin

[LittleAlf]

Many thanks for implementing the listing of the ACLs. That is exactly, what I was looking for.

My use of ACLs
I have a server, where I share main data directories with Windows clients. I try to mimic the Windows behavior when copying, moving inside these directories. Accordingly, my ACLs are quite extensive. Here an example of a getfacl command on a main data directory:

# file: Bilder
# owner: root
# group: root
# flags: -s-
user::rwx
group::rwx
group:SambaAdmin:rwx
group:SambaOthers:r-x
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:SambaAdmin:rwx
default:group:SambaOthers:r-x
default:mask::rwx
default:other::r-x

As can be seen, I make heavy use of

• specific group ACL settings
• mask settings
• default ACL settings
• usage of Setgid

In some directories I have specific user ACLs in addition.

Thoughts about displaying ACLs in file explorer
Right now each of the ACLs of a directory or file are displayed in a single line. So, the above directory would occupy 10 lines, mainly because of the default ACLs. I believe, this might be a little bit too much, because you will not have an actual list of the directories and files anymore.

What do you think about displaying the standard ACLs in one line and just add a hint, if special ACLs are used? Something like

user::rwx | group::rwx | other::r-x | more ACLs

or as a shorter form

u::rwx | g::rwx | o::r-x | more

The more ACLs (or more) would be shown only, if this file or directory has special ACLs attached to it. The full list of ACLs could then be displayed by clicking on a menu entry behind the three dots on this line, like display full ACL list. This, in turn would display just the result of the getfacl command on this file or directory.

The main advantage: each entry in the list would occupy just one line. The above example shows, that the length of this string is not too long, if you look for example at the length of the attributes string.

I know, the information shown in this column is identical to the info given in the mode column now. The only new thing is the more ACLs. I just believe, that it is not good to occupy a single line for each ACL entry.

[iliaross]

What do you think about displaying the standard ACLs in one line and just add a hint, if special ACLs are used? Something like

I don't even think we should display standard ACLs permissions (first three rows), as they are already displayed as octals in Mode column?

[iliaross]

Check latest commit. It will only display none default standard ACLs. I think mask:: could also be dropped?

[LittleAlf]

Regarding the commands I am using on the command line
Besides the chown and chgrp commands, this is mainly the setfacl command, which I use repeatedly with the modify option, for specific users and groups as well as for the default ACL settings. Using my example above (being in the parent directory of Bilder):

setfacl -m u::rwx,g::rwx,o::r-x Bilder
setfacl -m g:SambaAdmin:rwx,g:SambaOthers:r-x Bilder
setfacl -m mask::rwx Bilder
setfacl -d u::rwx,g::rwx,o::r-x Bilder
setfacl -d g:SambaAdmin:rwx,g:SambaOthers:r-x Bilder
setfacl -d mask::rwx Bilder

I have several directories with the same or very similar complex ACL setup. Here, I am using piping to copy the complete ACLs from one directory to the other:
getfacl Bilder | setfacl --set-file=- Videos

It would be really great if a command like >copy ACLs to another file or directory< would be available!

If you need some more information, please, let me know.

[LittleAlf]

Check latest commit. It will only display none default standard ACLs. I think mask:: could also be dropped?

mask:: is an important information, since it describes if access rights are transferred fully or not.

The number of non standard ACLs on a directory or file could be a still quite a lot. In my example you have 7 entries=7 lines, even without the mask entries. The default entries must show up, because this is one core feature of handling the inheritance of access rights with ACLs.

What do you think to indicate the existence of special ACL just with an 'X' in a column >special ACLs< or something shorter? Then with the three dots displaying the full ACL list as described above.

Or, if the number of entries exceeds 3, you write the first two ACLs and in the third line you write >more ...<.

In any case: your implementation is great already. I hope you don't mind, if I just suggest some tweaking.
;)

[iliaross]

In any case: your implementation is great already. I hope you don't mind, if I just suggest some tweaking.

I appreciate all suggestions. At the moment, I don't like the idea of hiding ACLs information. I think having it all displayed at a glance is better than searching through myriads of accordion elements.

[LittleAlf]

Okay. It is not as bad as I thought. Since you do not have dozens of directories with this many ACLs:

[iliaross]

This is what you have with the yesterday's commit, where defaults are not shown. You can pull the latest changes and see how it is right now, when all ACLs are shown, including defaults - what is your preference?

[LittleAlf]

Okay, here is how it looks now:

I prefer to display the special ACLs only!

Reasons:

1. Most important is, that you cannot easily recognize, which directory or file really carries special ACLs. If you have a list with files, all will have at least three lines for the standard ACL entries. If there is one file with only one additional entry it is much more difficult to spot it. If you show the special ACLs only means: no entry = no special ACLs.
2. The standard ACLs are nicely shown in the Mode column already. This column is easily understood and serves in addition to the new ACL column.
3. Each line in the table will gobble up three lines in any case. In most scenarios, this is an unnecessary waste of space, since you do not have any additional information considering the Mode column.
4. If you rename the column title to something like Special ACLs it would be clear, that this column has to be seen together with the Mode column.

As you can see: I really would like to get the ACLs without the defaults back.
;)

[iliaross]

As you can see: I really would like to get the ACLs without the defaults back.

Okay, great.

What about the mask:: then?

[LittleAlf]

The mask:: must be shown in the ACL column! It is only present, if the inheritance differs from the standard Linux behavior. Only if you show it you can clearly see how the inheritance of access rights for child files and folders works.

[LittleAlf]

Did you prepare another commit?

[iliaross]

No, I was working for the past days on re-working theme configuration page.

I will get back to this in a bit.

[iliaross]

Did you prepare another commit?

Yes, I also think that displaying non essential ACLs is waste of space and UI clutter. Fixed that.

[LittleAlf]

Thanks. I think the first round (=displaying ACL's) is very nice now. Many thanks for the great work.

[iliaross]

Yes, sure, thanks. I will add on the next releases ability to modify ACLs.

[verachell]

A big thank you for ACL support and for the ability to modify ACLs! This is wonderful! However, one problem I am running into is that existing ACL's do not seem to be preserved if I edit the file in the Webmin File Manager. If I edit the file and save it, the ACL's go away, only the regular permissions are preserved.

This seems to be the case if I'm logged in either as root or as a safe Webmin user.

Please correct me if I'm missing something, maybe there's a setting I missed in the preferences. Will there be a way in the future to automatically preserve existing ACL's when editing files? (or is there already and I missed it somehow?)

To reproduce the problem, firstly on the command line I observe the ACL's of my file of interest by doing getfacl filename . It shows the ACL's. I then log into Webmin, go to the file manager, the same ACL's are listed correctly for the file. Good so far. Then I open the file in Webmin, edit the file and save it. Then on the command line I do getfacl filename again. The ACL's are removed, leaving only the regular permissions. If I click the reload button in the Webmin file manager panel, the ACL's are also shown to be removed. I'm on Authentic Theme 21.10 in Webmin v 2.111

[iliaross]

Hello Vera!

Thanks for the heads up and the excellent bug report!

This issue has been addressed in this PR webmin/webmin#2211.

[verachell]

Oh wow thank you! I'm so happy that you created a solution for this!

I'm looking forward to when your fix is merged. ACL's are an incredibly helpful use case in Apache for me when website files reside in a user directory: the ability to assign r (or rx where needed) perms in those files to the Apache user www-data while setting go-rwx to those same files for security reasons. The ability to preserve those ACL permissions when editing files in the Webmin file manager is a huge help there. Thanks again!

[iliaross]

perms in those files to the Apache user www-data while setting go-rwx to those same

Ideally, files should never be owned by the Apache user; instead, they should be owned by the domain owner user. Consider not using mod_php, as it is behind PHP-FPM by far!

Perhaps you may find Virtualmin useful.

[verachell]

Thanks, and to clarify, the files in my use case are not owned by the Apache user. They're owned by the domain owner, I just want to give the Apache user read perms through ACL (hopefully that is an OK strategy but please let me know if it's not! ) Oh, and thank you for mentioning about PHP-FPM

[iliaross]

They're owned by the domain owner

Great!

I just want to give the Apache user read perms through ACL

What goals are you pursuing?

[verachell]

CGI programming