2

Assume I have groups G1, and G2, and user U.

User U is a member of both groups, but G1 is it's primary group.

In my file system there is a folder F which is accessible by G2. Now if U wants to access F the only way for it is to do newgrp G2, and then access, which is not what I want my users do all the time.

What should I do?

Concrete example:

ajalali@ws47lx:/projects/gchrupala$ stat .
  File: `.'
  Size: 17          Blocks: 0          IO Block: 1048576 directory
Device: 15h/21d Inode: 150         Links: 3
Access: (0775/drwxrwxr-x)  Uid: ( 6052/gchrupala)   Gid: ( 6000/nis_users)
Access: 2015-03-05 15:34:46.260662858 +0100
Modify: 2013-03-05 16:35:16.000000000 +0100
Change: 2013-06-10 20:40:25.418034444 +0200
 Birth: -
ajalali@ws47lx:/projects/gchrupala$ id
uid=1004(ajalali) gid=1001(ajalali) groups=1001(ajalali),6000(nis_users),6060(admin),6061(sudo),1625200000(admins),1625200001(lsv_local),1625200035(compute_server_users),1625200036(contact_server_users)
ajalali@ws47lx:/projects/gchrupala$ mkdir tmp
mkdir: cannot create directory `tmp': Permission denied

The user (ajalali) is a member of the group that owns the current folder (6000), but can not make anything there, cause it's primary group (1001) is not the group that owns current folder.

It will only work if the user does newgrp nis_users first, and then try to make a folder there.

  • That's not normal. Having G2 as a supplementary group should be enough to get its permissions. You should not need to newgrp to it. Is /projects or /projects/gchrupala perchance an unusual type of filesystem? – Celada Mar 6 '15 at 10:57
  • This is on the server: /dev/sdb1 on /projects type xfs (rw) And this is on the client: fs1lx.lsv.uni-saarland.de:/projects on /projects type nfs (rw,nodev,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=134.96.116.8,mountvers=3,mountport=39732,mountproto=udp,local_lock=none,addr=134.96.116.8,_netdev) – adrin Mar 6 '15 at 11:00
  • I think it should work on NFS too, but I have no recent experience with that. In any case, since it's NFS, do check out unix.stackexchange.com/questions/171284/… – Celada Mar 6 '15 at 11:04
  • 1
    install package acl on linux box and use setfacl command. – PersianGulf Mar 6 '15 at 11:25
  • @Celada: that post is specific to the UID of root, I'm aware of that problem. In my case, non of the users are root. – adrin Mar 6 '15 at 11:26
5

This looks like an NFS issue. Is NFS involved?

NFS servers running on Debian-based systems, and possibly others, are configured to ignore supplementary groups unless told specifically otherwise. Ensure that --manage-gids has been supplied to the rpc.mountd program. On Debian systems that is done by editing /etc/default/nfs-kernel-server and ensuring that RPCMOUNTDOPTS=--manage-gids is present.

  • 1
    Thanks, it was towards the right direction. My server had already RPCMOUNTDOPTS=--manage-gids included in the config, but it wasn't a member of my LDAP/Kerberos (IPA) server, so it wasn't able to resolve those GIDs. Thanks. – adrin Mar 6 '15 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.