Is it possible to set per-user permissions in Linux?

Question

Is this possible?

It seems that I have more options to set permissions in Windows than Linux.

Let's say I want to give a user full access to a top-level directory but limit their access to certain subdirectories.

Going one step further, how would I do this for multiple users?

Answer 1

In POSIX systems, a file can only have one user owner and one group owner. Normal posix permissions affect the access of the user owner, group owner, and everyone. I'll assume that you are already familiar with those.

In addition on Linux, an extended form of ACLs is available that allows specifying access permissions for additional users and groups. In Linux, most filesystems have to be specifically mounted with options to enable the storage of these ACLs. Usually, the mount option is "acl". That option is definitely supported by ext2/3/4 FSes. You can check for the option running the following in bash:

$ mount

or

$ cat /proc/self/mounts

Then look to see if the filesystem where you want to apply the ACLs has that mount option enabled. Assuming it does, you can use the getfacl and setfacl commands to manipulate the acls on file and directories. Here's an example of running getfacl:

$ getfacl ipxe/
# file: ipxe/
# owner: wt
# group: wt
user::rwx
group::rwx
other::r-x

In this case, I don't have any extended ACLs on the directory. If I had given user "foo" "rwx" permissions on that directory, you'd see an entry like user:foo:rwx in that output.

I hope this helps. Good luck.

Answer 2

You could invoke Linux ACLs if you are using an appropriate filesystem and have them activated.

Answer 3

"Permissions" in LINUX are handled by two mechanisms:

1. ownership
2. Read, Write, and Execute permissions.

Every file (or directory) has an owner and a group owner. See man pages for chown or the wiki

chown user:group file

Permission are set for the owner, the group and others. See man pages for chmod. or the wiki

chmod [options] file

options is either a numerical permission or a symbolic mode. (see the documentation or the wiki to understand this in better detail)

Users can be part of multiple groups.