2

Assume I have groups G1, and G2, and user U.

User U is a member of both groups, but G1 is it's primary group.

In my file system there is a folder F which is accessible by G2. Now if U wants to access F the only way for it is to do newgrp G2, and then access, which is not what I want my users do all the time.

What should I do?

Concrete example: 

ajalali@ws47lx:/projects/gchrupala$ stat .
  File: `.'
  Size: 17          Blocks: 0          IO Block: 1048576 directory
Device: 15h/21d Inode: 150         Links: 3
Access: (0775/drwxrwxr-x)  Uid: ( 6052/gchrupala)   Gid: ( 6000/nis_users)
Access: 2015-03-05 15:34:46.260662858 +0100
Modify: 2013-03-05 16:35:16.000000000 +0100
Change: 2013-06-10 20:40:25.418034444 +0200
 Birth: -
ajalali@ws47lx:/projects/gchrupala$ id
uid=1004(ajalali) gid=1001(ajalali) groups=1001(ajalali),6000(nis_users),6060(admin),6061(sudo),1625200000(admins),1625200001(lsv_local),1625200035(compute_server_users),1625200036(contact_server_users)
ajalali@ws47lx:/projects/gchrupala$ mkdir tmp
mkdir: cannot create directory `tmp': Permission denied

The user (ajalali) is a member of the group that owns the current folder (6000), but can not make anything there, cause it's primary group (1001) is not the group that owns current folder.

It will only work if the user does newgrp nis_users first, and then try to make a folder there.

Improve this question
7
  • That's not normal. Having G2 as a supplementary group should be enough to get its permissions. You should not need to newgrp to it. Is /projects or /projects/gchrupala perchance an unusual type of filesystem?
    – Celada
    Commented Mar 6, 2015 at 10:57
  • This is on the server: /dev/sdb1 on /projects type xfs (rw) And this is on the client: fs1lx.lsv.uni-saarland.de:/projects on /projects type nfs (rw,nodev,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=134.96.116.8,mountvers=3,mountport=39732,mountproto=udp,local_lock=none,addr=134.96.116.8,_netdev)
    – adrin
    Commented Mar 6, 2015 at 11:00
  • I think it should work on NFS too, but I have no recent experience with that. In any case, since it's NFS, do check out unix.stackexchange.com/questions/171284/…
    – Celada
    Commented Mar 6, 2015 at 11:04
  • 1
    install package acl on linux box and use setfacl command.
    – PersianGulf
    Commented Mar 6, 2015 at 11:25
  • @Celada: that post is specific to the UID of root, I'm aware of that problem. In my case, non of the users are root.
    – adrin
    Commented Mar 6, 2015 at 11:26

1 Answer 1

Reset to default
5

This looks like an NFS issue. Is NFS involved?

NFS servers running on Debian-based systems, and possibly others, are configured to ignore supplementary groups unless told specifically otherwise. Ensure that --manage-gids has been supplied to the rpc.mountd program. On Debian systems that is done by editing /etc/default/nfs-kernel-server and ensuring that RPCMOUNTDOPTS=--manage-gids is present.

Improve this answer
1
  • 1
    Thanks, it was towards the right direction. My server had already RPCMOUNTDOPTS=--manage-gids included in the config, but it wasn't a member of my LDAP/Kerberos (IPA) server, so it wasn't able to resolve those GIDs. Thanks.
    – adrin
    Commented Mar 6, 2015 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .