Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm a little confused on how to get this working.

I have ACL working and I need to create two goups:

  • github-total: group that the users in that group have permissions to the folder "/var/git" to read/write/execute.
  • github-read: group that the users in that group have permissions to the folder "/var/git" to read.

For the group "github-total" I have done the following:

As "git" user:

$ cd /var
$ mkdir github
$ chmod 770 github
$ ls -al
drwxrwx---+  3 git git   4096 Oct  4 21:48 github


# useradd andre -m
# passwd andre
# groupadd github-total
# usermod -a -G github-total andre
# id andre
uid=500(andre) gid=500(andre) groups=500(andre),502(github-total) context=user_u:system_r:unconfined_t
# cd /var
# setfacl -R -m group:github-total:rwx github
# setfacl -R -d -m group:github-total:rwx github
# getfacl github
file: github
owner: git
group: git
user::rwx
user:git:rwx
group::rwx
group:git:rwx
group:github-total:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:github-total:rwx
default:mask::rwx
default:other::---

Unfortunately this is not working for me, with user "andre", I cannot list "/var/github"

$ cd /var/github
bash: cd: /var/github: Permission denied

How can I list this folder adding a group to the ACL?

Best Regards,

PS: Sorry for my english...

share|improve this question
    
Does id without arguments show the necessary groups? –  grawity Oct 5 '11 at 6:09
    
Hi grawity. No, id without arguments does not show. What I can do to solve this? –  André Oct 5 '11 at 8:24

1 Answer 1

up vote 2 down vote accepted

You have updated the user account (/etc/group), however, your currently running processes are not in the new group yet. This is because each process has its own credentials, including the secondary group list, which – for login sessions – is initialized once at login time and inherited by your processes.

(id shows the credentials its own process has, and id username reads from the account database.)

To solve your problem, log out, then log in again. You will have the new group in the list.

For a temporary fix, you could su or sudo -s -u to yourself.

share|improve this answer
    
Had a winscp session open before I added them to the secondary group and was really puzzled. Would have been puzzled for a lot longer if I hadn't seen this. Thanks! –  Tom Jenkinson May 10 at 0:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.