Two users, Foo and Bar. Foo wants Bar to work on a project in Foo's home dir.
[foo]$ mkdir project [foo]$ # Set defaults [foo]$ setfacl -m d:u::rwx,d:g::rwx,d:o::--- project [foo]$ # Set defaults overrides for bar [foo]$ setfacl -m d:u:bar:rwx project [foo]$ # Set actual acls for project dir [foo]$ set facl -m u::rwx,g::rwx,o::--- project
Then foo starts creating files and dirs in the new project dir.
Now after ensuring that
bar has permission to get to the project dir (i.e. has suitable permissions on all the parent dirs),
bar has access to all these files and dirs, and can create their own, which inherit the ACL from project dir.
However, this then means that
foo's project folder contains stuff owned by
bar, which could might mean foo has no access. e.g.
[bar]$ # feeling annoying... [bar]$ cd /path/to/project [bar]$ mkdir -p -m 700 ha/ha [bar]$ dd if=/dev/zero of=ha/ha/evil bs=1G count=10
Now foo can withdraw bar's access to the project folder, but is stuck with a 10GB file that foo can't access, nor delete!
Is there a way to ensure foo always has full rights over any files/dirs created in a particular directory?