Let's say I have two users on a Debian GNU/Linux system: me
and otheruser
. Both are members of the group shared-media
. I can create a directory that is writeable by both:
$ sudo mkdir /srv/media/test-parent
$ sudo chown root:shared-media /srv/media/test-parent
$ sudo chmod g+w /srv/media/test-parent
$ sudo chmod g+s /srv/media/test-parent
$ ls -dlh /srv/media/test-parent
drwxrwsr-x 2 root shared-media 4.0K Apr 28 19:35 /srv/media/test-parent
Now, as otheruser
, I create a directory and a file within it:
$ sudo -u otheruser mkdir /srv/media/test-parent/zztest
$ sudo -u otheruser touch /srv/media/test-parent/zztest/one
Unfortunately, this new file cannot be deleted by other members of the group (assume the current user is me
):
$ ll /srv/media/test-parent/zztest/one
-rw-r--r-- 1 otheruser shared-media 0 Apr 28 19:36 /srv/media/test-parent/zztest/one
$ rm /srv/media/test-parent/zztest/one
rm: remove write-protected regular empty file ‘/srv/media/test-parent/zztest/one’? y
rm: cannot remove ‘/srv/media/test-parent/zztest/one’: Permission denied
How do I set up permissions so that otheruser
only ever creates files that are writeable and deletable by other group members?