Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This question already has an answer here:

Why cannot a user change the group permissions of files which he owns. Let's suppose I have user martin:

$ ls -lAd /home/martin/
drwx------ 8 martin martin 4096 Apr 20 01:06 /home/martin/

For some reason, I want user paul to be able to access my home.

$ chgrp paul /home/martin/
chgrp: changing group of `/home/martin/': Operation not permitted

Is there a security reason why a user cannot change the group ownership of his own files?

I am using Debian 7 (wheezy).

share|improve this question

marked as duplicate by terdon, slm, Anthon, strugee, jasonwryan Apr 21 at 21:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

1 Answer 1

up vote 8 down vote accepted

You can only chgroup to a group you are a member of:

$ groups
terdon sudo netdev fuse vboxsf vboxusers 
$ chgrp fuse file
$ ls -l  file
-rw-r--r-- 1 terdon fuse 531 Apr 15 19:17 file
$ chgrp mysql file
chgrp: changing group of ‘file’: Operation not permitted

This behavior is mentioned in the POSIX specs:

Only the owner of a file or the user with appropriate privileges may change the owner or group of a file.

Some implementations restrict the use of chgrp to a user with appropriate privileges when the group specified is not the effective group ID or one of the supplementary group IDs of the calling process.

The main reason for this is that if you aren't a member of a group, you should not be able to modify what that group has access to. This answer on chown permissions is also relevant.

Traditionally, on shared systems, you have a users group to which all regular users belong and that is the primary group of each user. That way, files are created owned by the users group and all users can read them.

Anyway, since that is not the way that Debian-based distros are set up these days, the way to give a specific user access to your directory would be to either

  1. Change the group ownership of the directory to a group that both you and the other user are members of;

  2. Just change the permissions of the directory accordingly:

    $ chmod 755 /home/martin
    $ ls -ld /home/martin/
    drwxr-xr-x 170 martin martin 491520 Apr 20 13:43 /home/martin/
    

    That will make the directory accessible to everybody. Paul included.

share|improve this answer
    
Or, if your filesystem has ACLs: setfacl -m "u:paul:rwx" /home/martin /home/martin/file where -m is add and -x is remove. –  Riking Apr 21 at 17:55
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.