3

I've been using Linux for a long time and I still am completely in the dark about how file permissions really work. With that in mind, does anyone have any books or thorough guides I could read to really understand things completely? I've done my fair share of sysadminning, so I know the easy stuff like making directories readable and writable, making files executable, and changing the owner of a file, but on sharing files across users, I'm lost.

Here's my main problem. I have a number of machines across which I intend to synchronize my music library. I've been using Unison for a while now and it's a great choice as I can easily run it over SSH on my local network which I just set up. Win-win.

Up until this point, I've been synchronizing computers using a 2TB external hard drive. (computer 1 unisons to HD, computer 2 unisons to HD, etc.) This is tedious at best, especially since I encrypted the drive, making it a huge hassle to hook it up to all of my machines and sync it. Anyway, the drive is running ext4 (in TrueCrypt), so it maintains all Unix filesystem info like owners and groups. I just set up a new machine and just Unison'd it to get the music on it, and I realized that now, all of my permissions are fubar. I had to run Unison as root since that was the only way I could get the files to come off of the external drive. Apparently, since I'm using a different user name on this machine than my usual "rfkrocktk" across all machines, this essentially throws a huge wrench in the gears.

Here's my use case. This laptop has two effective users, "leandra" and "rfkrocktk". I want to share music between these two users, so I symlinked /home/rfkrocktk/Music to point to /home/leandra/Music. How do I (a) allow both users access to read/write/delete files in this folder, and (b) keep everything nicely in sync without messing up file ownership?

EDIT

I was able to get things kind of working, but not completely yet. I set the group id of my music directory to my group media-users and I added both my main user rfkrocktk and the shared user mt-daapd to the group. Now, rfkrocktk can access the files perfectly, but mt-daapd cannot see anything in the directory. Here are my ids:

$ id rfkrocktk
> uid=1000(rfkrocktk) gid=1000(rfkrocktk) groups=1000(rfkrocktk),4(adm),20(dialout),24(cdrom),29(audio),46(plugdev),104(lpadmin),115(admin),120(sambashare),124(vboxusers),1001(jupiter),2002(media-users)

$ id mt-daapd
> uid=123(mt-daapd) gid=65534(nogroup) groups=65534(nogroup),2002(media-users)

I have tried setting mt-daap's main group id to the media-users group, but it doesn't change anything.

Here are my permissions on the /home/rfkrocktk/Music directory:

drwxr-Sr-- 201 rfkrocktk media-users 12288 2011-01-13 12:26 Music

Running sudo -i -u mt-daapd ls -l /home/rfkrocktk/Music yields nothing. How can I fix this?

Improve this question

4 Answers 4

Reset to default
5

I'd set the file owner to root, and the group to something like 'music', and then make it such that they are both members of the "music" group. Then, make the music directory setgid (which will mean that items created in the directory will inherit the group ownership of the directory itself). Then, make the file permissions 0660 and you're all set.

File permissions are user, group, world, and often shown as an octal number (e.g., 0660), where:

1 - exec 2 - write 4 - read

These are able to be added, so for example, 0751 means that the file owner can read, write, and execute; the group can read and execute; everyone else may only execute.

Improve this answer
4
  • Ok, so I just created a group named media-users, added both of my users to that group, then chgrpd my music directory to be grouped to the media-users` group like so: sudo chgrp -R media-users /home/$USER/Music. Then I chmodded that directory to have the following perms: sudo chmod -R 0744 /home/$USER/Music so that I can rxw, but users in the group can r. Should that be good enough? How do I do your setgid trick to keep newly created dirs in the group?
    – Naftuli Kay
    Jan 13, 2011 at 20:15
  • That should indeed be good enough, yes. To enable setgid on the directory, a simple chmod g+s dirname (or chmod g+s . if you are already in that directory) will enable the setgid bit on the directory's permissions. (You can use r, w, x, s, or t for the permission part, which is read, write, execute, set(uid|gid), or sticky, respectively.)
    – Michael Trausch
    Jan 13, 2011 at 20:25
  • Hmm, it seems I've hit a snag. If I try to ls the music directory as my other user, I can't see anything. :( This is the command that I ran to test this: sudo -i -u mt-daapd ls /home/$USER/Music. If I run it as my regular user, it works great. I've edited the post above containing new info about my users and groups. Could you please take a look?
    – Naftuli Kay
    Jan 13, 2011 at 20:41
  • Actually, solved this here: superuser.com/questions/232949
    – Naftuli Kay
    Jan 14, 2011 at 0:01
3

Names don't matter. Unix file and group ownership are stored in the filesystem and stored numerically, not by name. From your original machine open a terminal as your regular user and say:

id -u

This will give you the numeric ID of your user there. When checking for ownership of files a comparison is done between your logged-in user ID and the ID in the filesystem. When displaying the user name the ID is transformed into text by querying passwd, resulting in your local name.

On your new machine perform the same step as above. Is the ID different? If it is different then "you" on the new machine are not the owner of the files. On both machines, similarly, if you say

id -G

You will get a list of group IDs to which your user belongs. Each file's group must match one of those IDs or it is not group-owned by you. You can get a file's actual numeric user and group with ls -nd file or stat file.

In most cases two different systems will not have the same user IDs. You can manually sync them by editing passwd, but then you have to carefully update all files on the system to convert from any old IDs to the equivalent new ones. Synchronizing IDs between systems is a complex task most home users don't bother with; it's the domain of LDAP, NIS and other solutions like that.

In order to solve your problem you will want to make all of the files owned by a group ID which exists on both systems, then make sure users on both systems are members of the group, then grant read/write access (chmod g+rw) to that group.

Improve this answer
1

You can set the Music directory (and all its files and sub-directories) to have 775 permissions, so that the owner of the files, and anyone in the same group can do anything they want to the files. Then the next trick is to make a new group with whatever name you want (e.g. share) and chgrp the Music directory (and all its files and sub-directories) to the new group. Now you just have to make sure that users that you to grant read/write access to the shared files are in the "share" group. If you need to make this work with other computers just take care that the share group has the same numeric ID in all the computers and you'll be fine.

Improve this answer
0

Here's an explanation of permissions I found useful. This one, too.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.