4

I have set up two user groups, students and faculty on Ubuntu 12.04 and created a number of students and faculty accounts. The problem is a student can currently see & read all of the files of a fellow student :-/

I would like to prevent students from seeing/reading each others directories/files, but permit someone in the faculty group freely access to the student groups.

I'm not sure how to go about this, can anyone offer pointers on how to implement this policy? I know how to set/change groups, but not how to limit the policy to what they can do/see. (I've been a Linux user for a while, but administering more than my own account is new to me)

Also, would I have to change the umask for all student accounts to make sure this policy doesn't get circumvented with new files/directories students create subsequently?

Would I as root execute chmod go-rx /home/* on each student homedirectory to accomplish this goal, or am I going about this the wrong way?

UPDATE: Just to clarify, my goal is to have this as a default setup, I don't expect I can prevent informed/curious students from changing their own permissions - and I'm willing to live with that.

  • 1
    Take a look at this tutorial on ACLs: vanemery.com/Linux/ACL/linux-acl.html – slm Nov 29 '13 at 20:17
  • @slm Thanks for the link, it looks very useful/helpful. Do you also concur that ACLs are the way to go with my very limited requirements? I'll be happy to learn about them, but if I can easily/quickly do what I need with groups I'd be happy to do that first, and then explore ACLs. – Levon Nov 29 '13 at 22:32
  • 1
    See my answer for an alternative way, but I'd still do it using ACLs. – slm Nov 29 '13 at 22:49
2

I think I would attempt to do this using ACLs as well. The only other method I can conceive of doing this would be as follows.

  1. Create 2 groups students & faculty
  2. Each user's home dir. would be like this:

    drwxrws---. 253 student1 faculty 32768 Nov 29 16:39 student1
    

    This would allow anyone in the faculty group access to student1's directory, but no one else, except the owner, student1.

  3. chown -R student1.faculty /home/student1

  4. find /home/student1 -type d -exec chmod ug+rwx,g+s,o-rwx {} +

The trouble with this approach is that it can be a bit fragile if the owner were to mess with the group ownership, or were to mv files into this directory. Only newly created files/directories would persist the ownerships + setgid bit.

This setup requires that all the preexisting files/directories under /home need to be adjusted using steps #3 and #4 above.

ACLs

As I said above, I think I would still do this using ACLs. I would consult this tutorial on ACLs, titled: Using ACLs with Fedora Core 2 (Linux Kernel 2.6.5). The title makes it sound dated but the commands are still relevant.

1

What you should be looking at when setting up such granular permissions is to set up Access Control Lists, which will give you ability to enable access to User + Faculty.

There are plenty man pages on the commands setfacl and getfacl that will allow you to set up properly.

  • Thanks, I am not familiar with the acl setup, I'll take a look. It sounds as if the system has to be mounted with this feature enabled. I'm not sure I'll be able to do this since I'm using a Ubuntu VM via the MicroSoft Azure platform, but I need to take a closer look at both this command and the VM setup (the disks are not mounted with acl at this point I think - at least mount | grep acl didn't yield anything which was one recommended way to check for this). – Levon Nov 29 '13 at 17:27
  • 1
    @Levon Normally the acl package is not installed on Ubuntu so you will need to install it manually. In addition to that mountoptions will need it include acl in order to enable ACL on the filesystem as described in the Access Control List link I added. – Karlson Nov 29 '13 at 17:40
1

The first thing is to create two groups students and faculty and to make sure that all students and faculty members are in their appropriate group. Make that a secondary group: leave the default setup in place where each new user gets their own dedicated group.

Change the default umask so that all files are private by default. Change the UMASK line in /etc/login.defs to 027 (i.e. user can all, group can read, others can nothing). This way, all files will be private by default.

It will also help to put student home directories under a dedicated directory; for example, if Alice is a faculty member and Bob is a student, make their respective home directories /home/faculty/alice and /home/students/bob.

You can provide the faculty discretionary access to student directories by setting an access control lists in student directories. To grant the faculty group read access to all students' files, and to also grant access to newly created files by default, run the command

sudo setfacl -R -d -m g:faculty:rX /home/students
sudo setfacl -R -m g:faculty:rX /home/students

Students can still make files private by explicitly changing their mode (e.g. chmod go= somefile.

You can go further and give the faculty mandatory read access to all files. I don't recommend doing this, because students should be allowed to have private files. If you really want to set things up that way, consult with a lawyer first (even if students aren't allowed private use of these machines, that may give you the right to expel them if they don't comply, but not necessarily to read their private mails). That is, it is technically possible and not all that hard: see User with read access to /home

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.