31

On my server I have directory /srv/svn.

Is it possible to set this directory to have multiple group ownerships, for instance devFirmA, devFirmB and devFirmC?

The point is, I want to subversion version control manage multiple users accross multiple repositories and I do not know how to merge /srv/svn, the root directory of repositories, permissions. I have, for instance, three firms, FirmA, FirmB and FirmC. Now, inside /srv/svn I've created three directories, FirmA, FirmB, FirmC and inside them I've created repository for each project and now I do not know how to establish permission scheme since all elementes inside /srv/svn are owned by root:root, which is not ok, or am I wrong?

  • 1
    Do the firm groups access each others files? Or are they completely separate, other than sharing a parent directory? – J. M. Becker Apr 10 '15 at 23:39
  • @TechZilla firm group MUST Not access each others files, ther MUST be separated, only I must have access to all directories. – KernelPanic Apr 17 '15 at 9:57
  • OK, I posted the correct answer, you should not use ACLs for this. They are a last resort option, this problem is still a very common one. – J. M. Becker Apr 21 '15 at 20:05
16

This is an extremely common problem, if I understand it accurately, and I encounter it constantly. If I used ACLs for every trivial grouping problem, I would have tons of unmanageable systems. They are using the best practice when you cannot do it any other way, not for this situation. This is the method I very strongly recommend.

First you need to set your umask to 002, this is so a group can share with itself. I usually create a file like /etc/profile.d/firm.sh, and then add a test command with the umask.

[ $UID -gt 10000 ] && umask 002

Next you need to set the directories to their respective groups,

chgrp -R FirmA /srv/svn/FirmA 
chgrp -R FirmB /srv/svn/FirmB
chgrp -R FirmC /srv/svn/FirmC

Finally you need to set the SGID bit properly, so the group will always stay to the one you set. This will prevent a written file from being set to the writer's GID.

find /srv/svn/FirmA -type d -print0 | xargs -0 chmod 2775
find /srv/svn/FirmB -type d -print0 | xargs -0 chmod 2775
find /srv/svn/FirmC -type d -print0 | xargs -0 chmod 2775

find /srv/svn/FirmA -type f -print0 | xargs -0 chmod 664
find /srv/svn/FirmB -type f -print0 | xargs -0 chmod 664
find /srv/svn/FirmC -type f -print0 | xargs -0 chmod 664

Now finally if you want to prevent the directories from being accessed by other users.

chmod 2770 /srv/svn/FirmA
chmod 2770 /srv/svn/FirmB
chmod 2770 /srv/svn/FirmC
  • 2
    Warning: this should work but removes execution permission bit on all files. This is okay if your directory tree only holds documents. If it contains executable files this will prevent execution, which may ruin your setup. – Stéphane Gourichon Sep 8 '16 at 8:43
  • 1
    This might be also a nice idea, but does not answer the question at all. – ceving Sep 13 '17 at 11:16
  • This as described only partitions the three folders so that only members of each firm can modify only their respective files - it does not give 'svn' the access it needs. – rich p Oct 23 at 13:33
  • This is very close though. What's missing is to give you access to all the groups. Add this step, assuming your login is svnadmin: sudo usermod -a -G FirmA,FirmB,FirmC svnadmin This will add svnadmin to all of these groups. Since the files in all these groups have 'group write' enabled (chmod 664 did this), you, plus firmX, will be the only writers of files owned by firmX. – rich p Oct 23 at 13:49
  • 1
    Better - change the permissions to add/subtract what you want to add/subtract - e.g. do find /srv/svn/FirmA -type f -print0 | xargs -0 chmod ug+rw,o+r,o-wx – rich p Oct 23 at 14:18
25

You can only have one group as owner.

However using access control lists you can define permissions for other groups.

Check if you have ACL installed issuing the command getfacl. If your system hasn't ACL installed, install the command line tools which are in the acl package with: sudo apt-get install acl

With getfacl you can read the ACL information of a directory or other file, and with setfacl you can add groups to a file.

For example:

setfacl -m g:devFirmB:rwx /srv/svn/  

Adds the group devFirmB with read, write, execute permissions to directory /srv/svn.

If you also want files created in that directory to be owned by multiple groups, set the ACL as the default ACL. The X in the default group entry means “allow execution if executable by the owner (or anyone else)”.

setfacl -m g:devFirmB:rwx /srv/svn/  
setfacl -d -m g:devFirmB:rwX /srv/svn/  
6

It is not possible to have a file owned by multiple Linux groups with traditional Unix permissions. (However, it is possible with ACL.)

But you might use the following workaround and create a new group (e.g. called devFirms) which will include all users of the groups devFirmA, devFirmB and devFirmC.
You create new user groups with:

sudo addgroup NEWGROUPNAME

First, you might have to install id-utils to get the lid-command:

sudo apt-get install id-utils

Then you can run the following line of code to easily copy all users of SOURCEGROUP to TARGETGROUP. Of course you have to run the command once for each group you want to copy. Don't forget to replace the capitalized place-holders with the actual group names.

for u in $(lid -g -n SOURCEGROUP); do sudo usermod -a -G TARGETGROUP $u; done

So in your case you would have to run the command (all lines at once):

sudo addgroup devFirms &&
for u in $(lid -g -n devFirmA); do sudo usermod -a -G devFirms $u; done &&
for u in $(lid -g -n devFirmB); do sudo usermod -a -G devFirms $u; done &&
for u in $(lid -g -n devFirmC); do sudo usermod -a -G devFirms $u; done

Note that these commands only copy all users who are current members of the source groups. Every user who gets added later will also have to be manually added to your common group with the adduser command. Just replace once again the capitalized place-holders with the actual user and group name (devFirms):

sudo adduser NEWUSER TARGETGROUP

Thanks to Justin Ethier for his answer at Unix&Linux.SE: Add all users of one group to another group?

  • @Gilles do you thing your scheme would work for Subversion server multiple repositories with multiple users as in my update of question? – KernelPanic Apr 10 '15 at 16:00
2

No, this is not possible.

Each file (and so also directories) can only have one user and one group.

  • 6
    Providing an alternative approach to get the same or a similar result would be nice. – Byte Commander Apr 10 '15 at 11:38
2

In order to provide different rights to multiple groups or users use the following commands (Tested on RHEL 6 & 7):

To make new owner of group:

setfacl -m g:<group_name>:<rights you want to give eg.rwx> -R <directory_name>

To check current acl settings:

getfacl <directory_name>
  • Tested, works on Ubuntu 16.04.3 too – Dmitry Oct 27 '17 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.