Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two groups group1 and group2.

I need group1 users to be able to read-write (rwx) files owned by users in group2, but users in group2 cannot write to (r-x) files from group1.

All users in a group can read, but not write to, files on the same group (r-x)

I know that I can use ACL (Access Control Lists) to deal with it.

setfacl -m g:group1:rwx "directory owned by a group2 user"

the problem is that it must be set for every new folder. is there a way to set as default so that every new group2 user's file/folder have this permission applied?

will this default be applied if I create a new user in group2?

I know that the normal permissions are copied from /etc/skel to the home folder when a new user is created, but how to make the acl permissions to be copied too?

share|improve this question
up vote 0 down vote accepted

For default permissions its "-d". So you can use this:

setfacl -d -m g:group1:rwx "Main directory owned by group2 user"

Also do check the effective rights with getfacl. You may have to set the mask also.

share|improve this answer

You don't need ACLs.

Put all users from group1 also into group2. Then ensure you put the setgid bit the directories: all new files will owned by the directory owner, with similar permissions (setgid will be added to new subdirs).

# Setup as root
mkdir -p /tmp/test/1
chgrp group1 /tmp/test/1
chmod g+wsx,o= /tmp/test/1
mkdir -p /tmp/test/2
chgrp group2 /tmp/test/2
chmod g+ws,o= /tmp/test/2
# user1 is in groups users (primary gid), group1, group2 
# user2 is in groups users (primary gid), group2
# as user1:users
mkdir -p /tmp/test/{1,2}/d1
touch /tmp/test/{1,2}/{f1,d1/f1}
# as user2:users
mkdir -p /tmp/test/{1,2}/d2
touch /tmp/test/{1,2}/{f2,d2/f2}
# check the ownerships on everything
ls -la /tmp/test/{1,2}/{f{1,2},d{1,2},d{1,2}/f{1,2}}

If you do want to stick with ACLs, you need to look at default ACLs, you do similar to the above with them.

As for adding new users and /etc/skel/, I'm afraid you're out of luck there, the stock useradd command does not preserve any ACLs or xattrs when copying /etc/skel/.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .