up vote 1 down vote favorite
share [g+] share [fb]

I am working on HP Unix server. I have a directory in which users from different groups need to create files. And the users of a same group should have complete access to the files created by their group and only read access for the files created by other groups.

I tried to set sticky bit for the directory thereby to restrict access for other groups. But I face the following problem.

Created File1 from user1 of GroupA. When I tried to execute the 'rm' command from user2 of the same group GroupA, it doesn't allow as user2 is not the owner of the file.

can setgid (at directory level) or other command help me to sort this issue?

link|improve this question
Can't you use a subdirectory for each group? – ninjalj Nov 10 '10 at 19:56
feedback

migrated from stackoverflow.com Nov 11 '10 at 20:32

This question came from our site for professional and enthusiast programmers.

4 Answers

up vote 0 down vote

I don't think the sticky bit comes into play here. Standard UNIX security is based on three groups owner, group, and other. If you do an ls -la on the files you will see the permissions listed for those units; the first set will be the owner, the second the group, and the third everyone else. An 'r' equates to 4, a 'w' to 2 and an execute to one. If you do a chmod 660 to all files in the directory, you will give read/write privileges (4+2)to the owner and the group, with nothing for everyone else. Alternatively if you did a chmod 644 * the owner would have read/write (4 + 2) while the group and everyone else would have read only (4) privileges.

Alan

link|improve this answer
The sticky bit on a directory makes it so that a file within it can only be deleted by the owner. – Ignacio Vazquez-Abrams Nov 10 '10 at 19:13
@Ignacio I just removed a file that I didn't own from a directory that had the group sticky-bit on. – Steve Emmerson Nov 10 '10 at 20:08
@Steve Emmerson: Were you the owner of the directory? – ninjalj Nov 10 '10 at 20:18
@Alan: Even if I provide the file permissions as mentioned by you, I will not be able to remove a file by user2 when the file owner is user1 though they belong to the same group unless I provide write permission to the directory. Similarly for other groups to write to this directory, I need to provide write permission for them. But this allows the other group users also to delete the files which may not belong to their group. Thats where I tried to use the sticky bit for directory but it is restricting the access to the users of the same group. – GOPI Nov 11 '10 at 5:16
@ninjalj Yes, I owned the directory. In UNIX, deleting a file only requires write access to the parent directory: ownership and protection modes of the file are irrelevant. – Steve Emmerson Nov 11 '10 at 5:24
show 2 more comments
feedback
up vote 0 down vote

The only way to do what you want is to create a subdirectory for each group.

link|improve this answer
feedback
up vote 0 down vote

You can set umask to 002 in everyone's init scripts. From then on:

  • All the files they create will be rw- to them, rw- to their group and r-- to everyone else.

  • All the directories they create will be rwx to them, rwx to their group and r-x to everyone else.

link|improve this answer
@Frederic: I have umask sent to 022 in .profile for the user1. When I create directory from user1, the dir permissions are rwx to user1, r-x to group and r-x to everyone else. But when I create a file with the same user1, the permissons of the file are as follows rw- to user, r-- to group and r-- to others.. so umask seem to set the permissions at directory level and not at file level.. is that correct? – GOPI Nov 11 '10 at 4:51
@GOPI, that would be because directories are executable by default (to allow traversal), but files aren't. I tried to make that clearer in my answer. – Frédéric Hamidi Nov 11 '10 at 10:05
feedback

Your Answer

 
or
required, but never shown
discard