How to add a read only group permission to a folder that already has a default group, and have it inherited for all newly created files & folders?

Question

In Windows this is easy. I never fully figured out Linux permissions, I have a directory such as this:

/Photos

The current ACL permissions are as follows:

owner: root - full access
group: photos -full access
everyone: no access

the photos group currently has full access. But I would like to add an additional group that have read only access, called readOnlyPhotos, without enabling read access to "everyone".

That is, I want that folder to be inaccessible to anyone except for people who are either in photos group (who get full access) or readOnlyPhotos group (who get read only access). Also any new files and folders that get created in the /Photos folder should inherit these default permissions.

How can I configure the permissions on the /Photos folder to achieve this effect?

Answer 1

You cannot do this using traditional Unix permissions, you'll have to use ACLs, that's Access Control Lists. Traditional Unix permissions do not accommodate more than 1 group per file/directory. Window's uses something similar. The commands to apply ACLs are called setfacl and getfacl.

See my answer on this Q&A titled: Getting new files to inherit group permissions on Linux for an example that's similar to what you're looking for.