granting write permissions to a group to a folder

Question

How can I grant write permission to one group?

I have two users (alex and ben).

alex is member of group alex and of group consult.

ben is member of group ben and of group consult.

I want to grant read-write access to both alex and ben on the folder consult_documents.

If I make alex the owner of the directory consult_documents and I grant 775 access to the directory consult_documents, ben and alex will be able to access the folder, I think.

But will this allow ben access to alex's other folders as well? If a user is in two groups, does that mean that all the members from both groups get the same permissions on all folders?

Answer 1

Granting 775 permissions on a directory doesn't automatically mean that all users in a certain group will gain rwx access to it. They need to either be the owner of the directory or to belong to the directory's group:

$ ls -ld some_dir
drwxrwxr-x 2 alex consult 4096 Feb 20 10:10 some_dir/
              ^     ^
              |     |_____ directory's group
              |___________ directory's owner

So, in order to allow both alex and ben to have write access to some_dir, the some_dir directory itself must belong to the consult group. If that's not the case, the directory's owner (alex in your example), should issue the following command:

$ chgrp consult some_dir/

or to change group ownership of everything inside the directory:

$ chgrp -R consult some_dir/

This will only work if alex is a member of the consult group, which seems to be the case in your example.

This will not allow ben to access all of alex's directories for two reasons:

1. Not all of alex's directories will belong to the consult group
2. Some of alex's directories may belong to the consult group but alex may not have chosen to allow rwx group access to them.

In short, the answer depends both on group ownership and on the group permission bits set for the directory.

All of this is provided you don't use any additional mandatory access control measures on your system.

Answer 2

This will make alex and ben to colabrate each other in this Directory, And they can't collab in other Dir..

Modify the User group using

# usermod -a -G alex,ben alex

Then change the Permission for Folder

# chown alex:ben consult_documents

Check here i have worked it around

$ sudo usermod -a -G alex,ben alex

$ sudo chown alex:ben consult_documents/

cd consult_documents/

$ touch babin

drwxrwxr-x 2 alex ben  4096 Feb 20 15:19 .
drwxr-xr-x 3 alex alex 4096 Feb 20 15:17 ..
-rw-rw-r-- 1 alex alex    0 Feb 20 15:19 babin

$ su - ben

cd /home/alex/consult_documents/

ben@system99:/home/alex/consult_documents$ touch babin1
ben@system99:/home/alex/consult_documents$ ls -la
total 8
drwxrwxr-x 2 alex ben  4096 Feb 20 15:19 .
drwxr-xr-x 3 alex alex 4096 Feb 20 15:17 ..
-rw-rw-r-- 1 alex alex    0 Feb 20 15:19 babin
-rw-rw-r-- 1 ben  ben     0 Feb 20 15:19 babin1
ben@system99:/home/alex/consult_documents$

Answer 3

setfacl -m g:debian-transmission:rwx -R /mnt/sra

Found this command nice, instead of chown that will change completly the owner of the file or directory!

You will see on a 'ls -Al' that a + sign will be added to show that there is more than one owner!

drwxr-xr-x 2 root root 4096 Nov 8 19:11 sdc1/

drwxrwxr-x+ 3 root root 4096 Feb 17 19:16 sra/

And then you can use getfacl to see who can write or read the file or directory!

# file: sra

# owner: root

# group: root user::rwx

group::r-x

group:debian-transmission:rwx

mask::rwx

other::r-x

default:user::rwx

default:group::r-x

default:group:debian-transmission:rwx

default:mask::rwx

default:other::r-x

Answer 4

If I understood correctly your question, the answer is yes.

Let me explain:

Your folder and file access rights are divided into three categroies:

xxxyyyzzz
xxx are access rights for the owner
yyy are access rights for the owner's group
zzz are the access rights for everyone else

Every file and folder must be owned by a user.

Which means, if you have a folder named consult_documents, and you want it to be accessible from everyone of the group Consult, you will have this (with 755 access rights):

drwxrwxr-x Alex Consult [......]

The directory is owned by Alex, and the group is Consult. Alex has RWX access rights on it. Group Consult has RWX access rights on it. Other users have RX rights.

As your user Alex has several groups, you can choose the group to share with.

For example, if your folder is owned by Alex from groupe Alex:

drwxrwxr-x Alex Alex [......]

Do it:

chown Alex:Consult your_folder

It will become:

drwxrwxr-x Alex Consult [......]

And then the directory is available for the group Consult.

Please note that, as far as I know, you can add a group that is not one of the owner's group. But I'm not sure if it is recommended (not clear when reading access rights).