1

Is there a way to disable file permissions for a whole directory tree so that permissions of new files and directories are automatically disabled?

I have a multi user environment and want to have a directory tree where some of the users need full access, others only read access. Right now it is an easy scenario, but will get more complex.

I use RSBAC to model all rights of the users, but if the users in those shared folders create files or folder the default umask is 0022. So alice cannot edit bobs file in this shared folder. My current workaround is to write umask 0000 into $HOME/.profile of every user so that the files and folder can be edited by anyone.

This obviously leads to problems when the users want to write in other non-shared locations.

If this is not possible, is there an automatic way to set permissions to 777 for every new file and directory?

This should be a shared setting where the file owner cannot change the permissions/acls.

3
  • Couldn't you just run a cron job every minute that changes permissions accordingly? Also, if this is a general purpose system, make sure to inform your users about the umask workaround.
    – Daniel Beck
    Nov 11, 2012 at 17:49
  • @DanielBeck Sure, but sometimes I don't want to wait up to 10 minutes to edit some files.
    – Artjom B.
    Nov 11, 2012 at 17:56
  • You could look into moving the shared folder onto a separate server (CIFS/SMB) or file system and using a file system (FAT? NTFS) that does not support the Linux permissions model.
    – Daniel Beck
    Nov 11, 2012 at 18:27

1 Answer 1

2

ACLs are what you need. Look into the documentation of setfacl. Specifically, how to set default ACLs. You do need to enable ACLs on the filesystem by adding the option acl to the mount options and remounting.

2
  • The documentation of setfacl under permissions says that the file/dir owner can change the ACL. This shouldn't happen in a shared setting. I clarified this in the question. Although, I could probably restrict this with RSBAC and even ACLs.
    – Artjom B.
    Nov 11, 2012 at 18:04
  • 1
    @ArtjomB. just make the default to owned by you with 777 permissions maybe?
    – ssmy
    Nov 11, 2012 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .