1

I am a relative novice to Linux but was wondering how to enable the following:

  • There are three users A, B and C
  • I want users users A and B to have read write delete access to the home directory of C?
  • Files created by C will inherit the permissions

This will be on a Ubuntu server.

Any tutorials on permissions in Linux would be great as well!

2 Answers 2

2

ACLs are the new and cool way:

Edited to add group-based ACLs. I can't believe I actually forgot that.

  1. Enable ACLs for the filesystem.

    • mount -o remount,acl mountpoint

      where mountpoint might be / or /home depending on whether home directories are on a separate partition.

    • Add the acl option to the apropriate entry in /etc/fstab

  2. Create a group superusers and fill it with users. (Of course, pick a more apropriate name.)

    groupadd superusers
    gpasswd -M userA,userB superusers
    

    Alternatively, just use userC's usergroup. (In most Linux distros, user userC would automatically be in its own group, also named userC.)

  3. Update ACLs on the files:

    setfacl -R -m group:superusers:rwX,default:group:superusers:rwX ~userC
    

    where superusers is the group created earlier, and ~userC is the home directory of user C.

    The user:* and group:* permissions will apply to existing objects, and default:* to newly created ones. -R is for recursive.


The downside of POSIX ACLs is that each file has a copy of them -- no inheritance like on Windows, so when you want to allow or disallow someone access, you would have to edit the ACL of every affected file, whereas cmbrnt's method allows you to simply do a groupmod. Edit: Adding groups to the ACL sort of fixes this.

7
  • Didn't know about this method. Thank you for the tip!
    – cmbrnt
    Jan 14, 2011 at 23:51
  • This worked perfectly! Thank you for the good description :) I will need to learn more about ACLs and what exactly it is the commands are doing. Thank you :)
    – Malachi
    Jan 15, 2011 at 20:54
  • Would you know how to sort this out on my VPS. df -T yeilds /dev/simfs of type reiserfs - What would i put in fstab. This is a ubuntu 10.04 minimal install? Thanks again
    – Malachi
    Jan 24, 2011 at 20:00
  • @Malachi: For reiserfs, just add the same acl option to the fstab entry... Wait, I guess it's an OpenVZ with no fstab entry. In that case, use mount -o remount,acl / (and maybe put it in startup scripts). Jan 25, 2011 at 5:49
  • @grawity Yeah - it's an OpenVZ. When I try and run that command as root I get mount: permission denied? Any suggestions? I opened up a question regarding this on the ubuntu exchange: askubuntu.com/questions/23107/…
    – Malachi
    Jan 25, 2011 at 7:30
2

Since you say it's on an Ubuntu server, I'm going to assume you are using a command line interface (not graphical desktop). To change permissions for a single directory, but only for a limited number of users, you would need to change the group that that directory belongs to. Every file (and directory) belongs to one user, and one group. Let's say the group name is "superusers" (it could be anything).

  1. First off, create a new group by using the command addgroup superusers. You need to be root for this, or run with the sudo-command.
  2. Then you would change the group that the home directory of User C (/home/c) belongs to. This is done by the command chown -R :superusers. The -R flag makes sure every file in the directory gets owned by the superusers-group.
  3. Now you need to add user A and user B as members of that group. This is done by running one command for each user. Run sudo usermod -G superusers -a B. Naturally B is the name of the user you want to add to the group. The -a flag appends the group superusers to the list of groups user B is a member of. This is to make sure we don't mess something up. Do this once more for user A.

If you've followed these steps correctly and you had root privileges all along, you should now have the desired effect you're looking for. User A and B should be able to write and read to the home directory of user C.

In some cases, files may be readable or writable only by the owner. This is too much to explain here, but you can read up on "file permissions" and the chmod-command if you want to study further. A nice guide is available here. What it means is that some individual files can't be read or written to by the group - only by the owner. To change this, you would use the command chmod g+rw <file>, or chmod g+rw -R /home/C to change the permissions of every file in the home directory of user C. This adds read and write permissions to the group that the file is owned by, in this case group "superusers", as per step 2 in the guide.

As an addition, I'll say that this is not a recommended way of doing things. Normally you would create a third directory and give all three users read-write access to that directory.

I don't know of a way to make sure every file created in that directory will have the same user- and group ownership. You can add default permissions by using the umask-command, but that won't change the default ownership. I actually doubt this is doable, and actually against the *nix standards, but it would be great if anyone could correct me on that.

5
  • 1
    On Linux you can set default group ownership by setting the setgid bit on a directory - chmod g+s. As for user ownership, it's not a requirement and it would be just plain stupid to not own files you create. Jan 14, 2011 at 22:38
  • Right you are about the user bit, of course, sir. Didn't think that one through when I added the comment. :)
    – cmbrnt
    Jan 14, 2011 at 23:49
  • 2
    Another thing to consider is user groups: In most recent Linux distros, each new user is put in its own group - joe:joe as opposed to joe:users. (By the way, the latest version of shadow package includes a tool groupmems, allowing such users to modify their own usergroups' members. Another tool, gpasswd, can be used in a similar way too.) Jan 15, 2011 at 15:28
  • Thanks for all this help! I am slowly learning... is there a way to enable files created by A in /home/C to have group rw permissions? I can run sudo chmod g+rw -R /home/C, but that's a bit annoying having to run that each time.
    – Malachi
    Jan 15, 2011 at 16:38
  • 2
    @Malachi For this type of automation I suggest you turn to the answer grawity gave. It seems to be the more "correct" way to do this.
    – cmbrnt
    Jan 15, 2011 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .