Sharing a directory between users (using ACL) when some files are created with only owner rw (600) permissions

Question

Background:

I'm trying to share a folder between two users on the same machine . The normal way would be to have the two users in the same group set the parent folder to that group with rw and the s bit set.

That works great. Except .... the folder I am trying to share is one used by Chromium. When Chromium launches it writes some session files with only owner rw (i.e 600) permission ignroing the s bit. I guess some misbehaved programs can do that. That means when the other user tries later to open that same chromimum profile they can't set those sessions files cause they already exist with the owner only rw of the other user. :(

I gave bindfs a try but that requires sudo at login and thus I have to use a sudoers.d file if I want to get that set up non-interactive at login.

Anway I gave ACL a try and am not grokking some aspect because it's not working like I think it should.

# user1: syadmin
# user2: david
# directory: /opt/stest
# user1 sysadmin is logged in.

# sysadmin owns /opt/stest
$ llag stest
drwxrwsr-x+  2 sysadmin users    4096 Feb  3 13:45 stest/

$getfacl stest
# file: stest
# owner: sysadmin
# group: sysadmin
user::rwx
group::rwx
other::r-x

# now run
setfacl -R -m u:david:rwX /opt/stest
setfacl -dR -m u:david:rwX /opt/stest

# gives
user:david:rwx
default:user:david:rwx

#now create a file as other user
$ su david -c "touch /opt/stest/test"
-rw-rw-r--+  1 david    users    0 Feb  3 13:51 test

#set with owner only rw like how chromium does
-rw-------+  1 david    users    0 Feb  3 13:51 test

$ getfacl test
# file: test
# owner: david
# group: users
user::rw-
user:david:rwx          #effective:---
group::rwx          #effective:---
mask::---
other::---

So this is the part I'm not getting. Why is the "non-acl" owner of the file test david

# file: test
# owner: david

instead of sysadmin given sysadmin owns the directory. Bascially I thought that setfacl would always give access to the directory owner. It seems as though even if the acl entry was made by sysadmin sysdamin must be manually added to any file created by another allowed user or it can get locked out of its own files. That was not intuitive for me.

Is that what i need to do? Do I need to run inotify wait on the directory and then add sysamdin to the acl list if another user creates a file. What is the best solution to my situation ACL or otherwise.

I am running ubuntu 20.04 with kernel 5.4.0-65-

--two days later

I tried another tack. I added both users to the file and default acl list using sudo. Then I logged out and into the other user. Then did a getfacl on one of the offending files. You see both users listed but under effective there is nothing instead of rw. Arrgh. Still the current user sysadmin can't access the file created by david. Why is effective not showing rw???

-rw-------+ 1 david david 125146 Feb 6 09:12 Preferences

getfacl Preferences 
# file: Preferences
# owner: david
# group: david
user::rw-
user:sysadmin:rwx       #effective:---
user:david:rwx          #effective:---
group::rwx          #effective:---
group:users:rwx         #effective:---
mask::---
other::---

Answer 1

Ok, looking like I solved this. I can open chromium from either user with exact same user-dir/profile.

The trick is add all users to the acl owners list both for existing files and as default. Then to get the mask set run some chmod commands and do that all recursively.

To make this easy I wrote script and it's here.

https://gist.github.com/dkebler/23c8651bd06769770773f07854e161fc

I will keep it updated and with bug fixes but so far its working for me. If you are going to try it I strongly suggest experimenting on a test directory as you can easily mess things up. I did write in a bunch of confirmations to avoid this but still read the script and use at your own risk.

That said here is output from the script showning the commands executed.

david@giskard:[common/applications] $ share_dir -o root . sysadmin david
share directory /mnt/AllData/users/common/applications/ with users: sysadmin david ? confirm y
adding acl user sysadmin
these are the acl commands that you will run
******************
sudo setfacl -R -m u:sysadmin:rwX /mnt/AllData/users/common/applications/
sudo setfacl -dR -m u:sysadmin:rwX /mnt/AllData/users/common/applications/
******************
Double Check. Do you want to continue? y
*** new acl entries ***
user:sysadmin:rwx
default:user:sysadmin:rwx
adding acl user david
these are the acl commands that you will run
******************
sudo setfacl -R -m u:david:rwX /mnt/AllData/users/common/applications/
sudo setfacl -dR -m u:david:rwX /mnt/AllData/users/common/applications/
******************
Double Check. Do you want to continue? y
*** new acl entries ***
user:david:rwx
default:user:david:rwx
done adding acl users sysadmin david
these are the chown/chmod commands that you will run
******************
sudo chown -R root:users /mnt/AllData/users/common/applications/
sudo chmod -R u+rwX /mnt/AllData/users/common/applications/
sudo chmod -R g+rwX /mnt/AllData/users/common/applications/
sudo find /mnt/AllData/users/common/applications/ -type d -exec chmod g+s {} +
******************
Double Check. Do you want to continue? y
all done!
total 24
drwxrwsr-x+ 2 root users 4096 Feb  6 13:05  ./
drwxrwsr-x+ 5 root users 4096 Feb  6 11:39  ../
-rwxrwxr-x+ 1 root users  169 Jan 30 11:01 'Hacking Chromium.desktop'*
-rwxrwxr-x+ 1 root users  161 Jan 30 16:03 'Incognito Chromium.desktop'*
# file: /mnt/AllData/users/common/applications/
# owner: root
# group: users
# flags: -s-
user::rwx
user:sysadmin:rwx
user:david:rwx
group::rwx
mask::rwx
other::r-x
default:user::rwx
default:user:sysadmin:rwx
default:user:david:rwx
default:group::rwx
default:mask::rwx
default:other::r-x