Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Suppose I have two users A and B and a group G and a folder foo, both users are members of G (using linux and ext3).

If I save as user A a file under foo, the permissions are: -rw-r--r-- A A. However it is possible to achieve that every file saved under some subdirectory of foo has permissions -rwxrwx--- A G (i.e. owner A, group G)?

share|improve this question

3 Answers 3

up vote 26 down vote accepted

You can control the assigned permission bits with umask, and the group by making the directory setgid to G.

$ umask 002            # allow group write; everyone must do this
$ chgrp G .            # set directory group to G
$ chmod g+s .          # files created in directory will be in group G

Note that you have to do the chgrp/chmod for every subdirectory; it doesn't propagate automatically (that is, neither existing nor subsequently created directories under a setgid directory will be setgid, although the latter will be in group G).

Also note that umask is a process attribute and applies to all files created by that process and its children (which inherit the umask in effect in their parent at fork() time). Users may need to set this in ~/.profile, and may need to watch out for things unrelated to your directory that need different permissions. modules may be useful if you need different settings when doing different things.

You can control things a bit better if you can use POSIX ACLs; it should be possible to specify both a permissions mask and a group, and have them propagate sensibly. Support for POSIX ACLs is somewhat variable, though.

share|improve this answer
3  
Subdirectories created after setting setgid on the parent directory will have setgid set automatically. –  Arrowmaster May 8 '11 at 21:14
1  
@Arrowmaster: On some systems, perhaps, but not all; I tested on OSX and it doesn't propagate, at least for non-root. –  geekosaur May 8 '11 at 21:16
    
Well on Debian (and I assume most other Linux distros) the setgid and group name both propagate. –  Arrowmaster May 8 '11 at 21:19
1  
On OS X, the setgid bit on a directory is just ignored; new files and directories are always given the group of their containing directory. –  John Flatness May 9 '11 at 1:52
    
Is it also possible that files copied or moved to foo (using cp resp. mv) gain the desired permissions automatically (-rwxrwx--- A G)? –  student May 10 '11 at 20:15

If at all possible, use access control lists (ACL).

Under Linux, make sure that the filesystem you're using supports ACLs (most unix filesystems do). You may need to change the mount options to enable ACLs: with ext2/ext3/ext4, you need to specify the acl mount option explicitly, so the entry in /etc/fstab should look like /dev/sda1 / ext4 errors=remount-ro,acl 0 1. Run mount -o remount,acl / to activate ACLs without rebooting. Also install the ACL command line tools getfacl and setfacl, typically provided in a package called acl.

Now that the one-time setup is over, change the directory's ACL to give the group write permissions and to make these permissions inherited by newly created files. Under Linux:

setfacl -d -m group:G:rwx /path/to/directory
setfacl -m group:G:rwx /path/to/directory

If ACLs are not an option, make the directory owned by the group G, and set its permissions to 2775 or 2770: chmod g+rwxs /path/to/directory. The s here means the setgid bit; for a directory, it means that files created in this directory will belong to the group that owns the directory.

You'll also need to set A and B's umask to make all their files group-writable by default. The default umask on most systems is 022, meaning that files can have all permissions except write by group and other. Change that to 002, meaning to forbid only write-by-other permission. You would typically put that setting in your ~/.profile:

umask 002    # or 007 to have files not readable by others
share|improve this answer
2  
+1 - Very thorough answer. I never knew one could remount / on-the-fly. Good to know. –  boehj May 8 '11 at 19:56
1  
Thie setfacl -d command does not work for me because the files contained within that directory have an r-- mask that negates any write permissions. Would love some help. See unix.stackexchange.com/questions/71743/… –  Ben McCann Apr 8 '13 at 22:26
    
Nice answer, but after following all these steps, it seems that when I untar a file, it inherits the permissions of the file as it was inside the .tar file. So I end up with something that works for normal usage, but as soon as someone extracts a .tar file, no one else can edit anything inside it. Do you know if there is anything I can do about that? –  Mike Jun 5 at 22:20
1  
@its_me Q1: I show a mount command with the remount option, so it doesn't use fstab. Having acl twice means that the filesystem was mounted with the acl option already, and it harmless. acl is the default for ext4 in recent kernels, by the way (the patch was still brand new back when I wrote this answer). Q2: You can run the commands in either order. –  Gilles Jun 18 at 21:30
1  
@its_me Yes, your understanding is correct, it's just that it doesn't matter in what order you add the entries –  Gilles Jun 18 at 21:39

This question is a good fit for linux acl. Since you don't state your OS, I'll assume Linux in what follows. Here is an example session.

I don't know of a really good acl tutorial, but you could do worse than http://www.vanemery.com/Linux/ACL/linux-acl.html

Note that the default acl behaves like a local umask. Since at least in Linux, umasks are applied globally, this is the only way I know to get the effect of a local umask. For some reason this a little known feature. The net is littered with people asking about a local umask override, but almost nobody seems to think of using acl.

Also note that you need to mount the partition you are working in with acl support, eg.

/dev/mapper/debian-acl /mnt/acl        ext3    defaults,acl        0       2

Session follows:

/mnt/acl$ mkdir foo
/mnt/acl$ getfacl foo
# file: foo
# owner: faheem
# group: faheem
user::rwx
group::r-x
other::r-x

Set the group of foo to be staff, and set the acl of group and user of foo to rwx.

/mnt/acl$ chgrp staff foo
/mnt/acl$ setfacl -R -m u::rwx,g::rwx foo
/mnt/acl$ getfacl foo
# file: foo
# owner: faheem
# group: staff
user::rwx
group::rwx
other::r-x

Set default acls of user and group to rwx as well. This defines permissions that files and directories inherit from foo. So all files and directories created under foo will have group permissions rw.

/mnt/acl$ setfacl -d --set u::rwx,g::rwx,o::- foo
/mnt/acl$ getfacl foo
# file: foo
# owner: faheem
# group: staff
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx
default:other::---

Now create some files in foo as users faheem and john.

/mnt/acl$ cd foo
/mnt/acl/foo$ touch bar

# switch to user john for this next command.

/mnt/acl/foo$ touch baz

List files. Notice that both files owned by faheem and files owned by john are created with group permissions rw.

/mnt/acl/foo$ ls -la
total 3
drwxrwxr-x+ 2 faheem staff  1024 May  9 01:22 .
drwxr-xr-x  4 faheem faheem 1024 May  9 01:20 ..
-rw-rw----  1 faheem faheem    0 May  9 01:20 bar
-rw-rw----  1 john   john      0 May  9 01:22 baz
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.