Can users in a group access a file that is in another user's home directory?

Question

I have 3 users A,B and C inside a group 'admin'. I have another user 'D' in whose home directory, there is a project folder. I have made D as the owner of that folder and assigned 'admin' as the group using chgrp. Group and owners have all the permissions, but still A,B or C are unable to access the folder. I have two question :

1. Is it even possible for other users to access anything in another user's directory

2. Giving rights to a group only makes the users in that group have access to files that are outside any user's home directory ?

Edit : Here is how I had set the owner and group of the project

sudo chown -R D project
sudo chgrp -R admin project

I got an error while trying to get into the project folder within D's home directory (while being logged in as A)

cd /home/D/project
-bash: cd: /home/D/project: Permission denied

Here is the output of ls -la command :

drwxrwsr-x 7 D admin      4096 Nov 18 13:06 project

Here is the description of the group admin :

getent group admin
admin_users:x:501:A,B,C

Also note that group admin is not being listed when I type groups from the user D, but was visible when I used cut -d: -f1 /etc/group. The user I am referring to as D is actually ec2-user(the default Fedora user on Amazon servers)

Ultimately, I'm setting up a git repository on a server. I have created the repo in D's home directory, but wish A, B and C to have access to it too (and clone them)

Answer 1

1. Yes it is possible for users to access files in another users home directory.
2. No, there is no special treatment of home directories outside the system file permissions. "Giving rights to a group" involves two parts, granting group ownership, and setting group permissions. Your example deals only with ownership.

You can set permissions recursively with the chmod command but that alone may not guarantee that new files created by one member of the group will be accessible to the others.

Thank you for the account of what you've done so far, with adequate details, and for stating your goal to share git repositories.

Let's first look at how to accomplish group file sharing on Unix and Linux in a general way, and then look at some considerations for git.

Basic Group File Sharing Configuration

Here are some basics of this type of file sharing in Unix and GNU, etc. This is a simple way to set up a one or more directories where all members of a group have read and write permissions on files created by other users in the group.

Let's assume your common user group will be gitusers and the directory is repo.

1. Put sharing members into a common group (for example gitusers).

2. Set umask 002 for all of the users in the group, indicating that most files will be created group-writable by default. This may be set in various shell startup files (such as /etc/bash.bashrc). On GNU/Linux systems see man 8 pam_umask and man umask for more and better information.

3. Set group ownership recursively (-R) on all shared files:

   chgrp -R gitusers repo
   

4. Set group read and write permissions recursively on all files:

   chmod -R g+rw repo
   

5. Set the set group id on execution bit (setgid) of repo and all subdirectories. The setgid indicates that newly created files and subdirectories in that directory inherit the same group ownership as the parent directory. New subdirectories also have the setgid bit set, for a recursive effect:

   find repo -type d -exec chmod g+s {} \;
   

After the above steps, you should be well on your way for all users in the same group gitusers in the example, to read and write each other's files, while disallowing write permission for users not in the gitusers sharing group. You can replicate the chown, chmod and find command on as many directories as you wish, for any sharing purpose you wish, not just git.

Sharing git Repositories

It appears that git may work OK with only the above configuration changes. However git also knows about sharing and group permissions (and may actually do some of the above for you).

If you're creating a shared git repository, consider these options:

git init --bare --shared=group  repo

If you have an existing repository, consider these settings:

1. core.bare
2. core.sharedRepository=group

See the git-init man page and the git-config man page for more details.

Notes

While a bare, group-shared git repository will take care of some of the same steps as in the general example, I would recommend performing the steps in the general example as well to ensure consistency and also ease in setting up any other shared directories.

Answer 2

Some points that seem to be necessary (though I freely admit that I am not expert in these matters), and that were not covered in RobertL's otherwise admirably thorough answer.

1. Make sure that the other users have actually logged into group admin:

A$ newgrp admin

Since the users are already in the group, I think you will not need to set a group password. If you do:

A$ sudo chgpasswd
admin:secret (typed into stdin)

2. Make sure that D's home directory is in group admin and is group-searchable.

D$ chgrp admin ~
D$ chmod g+x ~
D$ ls -lad ~
drwx--x--- 3 D admin 4096 Nov 24 19:25 /home/D

The directory needs to be searchable to allow users to enter it or its subdirectory project. It doesn't need to be group-readable, so D's own filenames are still private. To let the other users get to project easily, have them create symbolic links to it; otherwise, they'll have to type the whole path each time (autocomplete won't work because the shell can't read the pathname, it can only go to it).