3

Is it possible to share a directory with one other non-root user, but only this one, without root privileges?

  • The system is Ubuntu with kernel 4.4.0.

  • I do not have root privileges.

  • The system has a large number of users; the administrators would be unlikely to agree to create a new group just for me.

  • The system does not allow me to use setfacl (probably no acl package installed)

Approach 1: Using the per-user group (does not work)

If I had root privileges, I could add the other user to my user group and grant that group the rights to the directory (assume the users are user_a (me) and user_b (the other) and the directory is ~/shared_directory):

sudo usermod -a -G user_a user_b

(this would add user_b to group user_a, user_a's user group)

chgrp user_a ~/shared_directory

(this sets the owner group of ~/shared_directory to user_a; in almost all cases this should already be the owner group and the command should not be necessary)

chmod g=rwx ~/shared_directory

(this gives the group all rights to read, write, and execute (access) the directory).

However, I do not have root access and am not allowed to execute usermod or to write to the relevant file /etc/group (which would be bad!).

Approache 2: Using file access control lists (ACL) (does not work)

Also, I can neither execute setfacl nor locate this executable; probably because the acl package is not installed. I consequently cannot attempt to use the approach suggested in this answer:

setfacl -m u:user_b:rwx ~/shared_directory

(This would give user_b access to the directory as desired, provided the filesystem and kernel support ACL.)

My feeling is still that approach 1 (user group and permissions) should be the key to solving this

Should I not be allowed to control who is part of my user group? Or am I misunderstanding the purpose of the users' identically named user groups?

Some of the answers to this question in Unix&Linux discussed role, rights, and purpose of per-user groups.

Or is there another way to achieve this that does not require root privileges?

  • 1
    I suspect you need to work with your sysadmins. – Zoredache May 30 '18 at 20:13
  • 1
    If the feature is implemented in kernel options (Ubuntu? it is), is not disabled ("noacl" isn't used for /home or alike) and likewise the mount point does allow execution ("noexec" isn't used for /home) then not having the command installed won't prevent to run a local version of the command. You could simply download the packages (including dependencies ), unpack them somewhere in your user directory, and with a few tricks (LD_LIBRARY_PATH ...) run the command from there. But if this deemed forbidden, the sysadmins could just add the two options above to prevent it anyway – A.B May 30 '18 at 21:42
  • 1
    of course setfacl doesn't require root privileges. having both your account and the other account with a common dedicated group does require root privilege to add it. Else you can pick a common generic group if it exists. eg: both users in the cdrom group? that's a common group. Hoping there's no interaction with apparmor/selinux – A.B May 30 '18 at 21:52
  • @A.B This is a cool idea. I can download and execute getfacl and setfacl, even without any fiddling with library dependencies. However, you are right that this will not work if it is disabled in the kernel; I am getting Operation not supported. Guess that means the kernel does not allow it. – 0range Jun 7 '18 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.