How do I create a hierarchy of UNIX groups as below?

Question

I need to create a hierarchy of UNIX groups. Something like below:

A
|\
| \
B  c
|\
D e
|\
f g

...where A, B and D are UNIX groups and c,e,f and g are UNIX accounts that are members of those specific groups. I have googled a lot but it seems that this is not possible.

Currently, we have the following:

1. Group A has members c.
2. Group B has members e.
3. Group D has members f,g.

---

UPDATE:

@John's post made me realize that I needed to re-frame my requirements to remove the ambiguity.

What I require is:

1. Limit access to a directory only to members of group B (so B is group owner of that folder). As group D is a sub-group of B, members of D would be members of group B and have access to that directory as well.

2. But members of Group B needs to have the same rights as members of group A. (So if group A is a directory group owner then automatically group B is the directory group-owner).

   By the way, this is a real-world problem where I have full control over group B and its members; and limited or no control over other groups and their members. So I cannot create new groups and give membership to members from group A or D.

Answer 1

With normal unix permissions, you can't do this.

With ACLs you can (or should be able to).

You need to be using a filesystem that supports ACLs. Most modern linux filesystems do.

The basic command is setfacl

In your example, if group B owns directory /B you would add access rights for group D as follows:

setfacl -m group:B:rwx,group:D:rwx /B

This is only the most basic example but might get the idea across. This does require careful and explicit setting of access control, but can do much more than basic unix permissions. It isn't nearly as capable as, as full AD group policy and the like, though.

Here's some documentation of ACLs in general

Answer 2

As Ulrich says, you can't do this with traditional groups. Your file permissions are limited to one owner, one group, and "everyone else". You may be able to accomplish your access requirements by having users in multiple groups, but even then limits 1 and 3 are mutually exclusive, presenting a problem. The solution you need is based in either LDAP or filesystem ACLs, I'm not sure which without knowing a lot more about the problem.