Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need to create a hierarchy of UNIX groups. Something like below:

A
|\
| \
B  c
|\
D e
|\
f g

...where A, B and D are UNIX groups and c,e,f and g are UNIX accounts that are members of those specific groups. I have googled a lot but it seems that this is not possible.

Currently, we have the following:

  1. Group A has members c.
  2. Group B has members e.
  3. Group D has members f,g.

UPDATE:

@John's post made me realize that I needed to re-frame my requirements to remove the ambiguity.

What I require is:

  1. Limit access to a directory only to members of group B (so B is group owner of that folder). As group D is a sub-group of B, members of D would be members of group B and have access to that directory as well.
  2. But members of Group B needs to have the same rights as members of group A. (So if group A is a directory group owner then automatically group B is the directory group-owner).

    By the way, this is a real-world problem where I have full control over group B and its members; and limited or no control over other groups and their members. So I cannot create new groups and give membership to members from group A or D.

share|improve this question
2  
You don't with normal groups. You may could use something else like LDAP –  Ulrich Dangel Mar 7 '13 at 14:24
    
Thanks @UlrichDangel. Okay, we are using LDAP groups. Except B is a local group. So if I request the LDAP admins to create group B as a LDAP group then how should I go about requesting for this hierarchy..? Could you kindly point me in the right direction. –  Kent Pawar Mar 7 '13 at 14:32
1  
TBH i don't think it will work with local groups. And I also don't know enough of LDAP but afaik, at least for some products, it should be possible to have virtual groups, e.g. groups consisting of other groups. Please be aware that I don't know if this is the proper term. –  Ulrich Dangel Mar 7 '13 at 17:10
    
@UlrichDangel - Will get back to you if I come across anything like that. Right now I am looking into ACLs.. –  Kent Pawar Mar 8 '13 at 13:57

2 Answers 2

With normal unix permissions, you can't do this.

With ACLs you can (or should be able to).

You need to be using a filesystem that supports ACLs. Most modern linux filesystems do.

The basic command is setfacl

In your example, if group B owns directory /B you would add access rights for group D as follows:

setfacl -m group:B:rwx,group:D:rwx /B

This is only the most basic example but might get the idea across. This does require careful and explicit setting of access control, but can do much more than basic unix permissions. It isn't nearly as capable as, as full AD group policy and the like, though.

Here's some documentation of ACLs in general

share|improve this answer
    
Thanks @SuperMagic for your inputs! I will need a while to get familiar with ACLs and decide whether it satisfies the requirements. –  Kent Pawar Mar 8 '13 at 13:45
    
The below points seem to satisfy my requirements, though different then what I had originally planned.. But do you see any issue with this while using ACLs? .. as I am still getting acquainted with them. 1. Each user in group B and D have membership to group A. 2. Directory owned by group B is made accessible only to group B and its members. 3. Using ACLs I will allow group D members to access the above directory. (Your example shows this..) Thanks! –  Kent Pawar Mar 8 '13 at 14:10

As Ulrich says, you can't do this with traditional groups. Your file permissions are limited to one owner, one group, and "everyone else". You may be able to accomplish your access requirements by having users in multiple groups, but even then limits 1 and 3 are mutually exclusive, presenting a problem. The solution you need is based in either LDAP or filesystem ACLs, I'm not sure which without knowing a lot more about the problem.

share|improve this answer
    
Thanks John. Sorry, I didn't understand the part "...but even then limits 1 and 3 are mutually exclusive...". Also if there is any more specific information I could provide you with, please do let me know. –  Kent Pawar Mar 7 '13 at 14:39
    
It means exactly what it says. Limit 1 instructs you to limit access to a certain directory to members of group B. Limit 1 then instructs you to ensure all members of group D have the same access to the previously mentioned directory, violating limit 1. –  John Mar 7 '13 at 15:07
1  
Note that LDAP is just a directory, which can hand out data for an account or group in this case, nothing more. It won't let you go past the (smallish) number of groups an account can belong to (that is fixed by the kernel), and doesn't help in the resultimg mess of "Hum, I need to share this with A, but leave out B and D, so the right group is..." –  vonbrand Mar 7 '13 at 19:13
    
@John - The limits I had mentioned were a bit ambiguous, hence my confusion when who pointed out that #1and #3 were mutually exclusive. I have updated my post accordingly. –  Kent Pawar Mar 8 '13 at 13:43
1  
Yes, ACLs the only practical way. –  vonbrand Mar 8 '13 at 13:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.