Access from multiple users to same directory but can't change directory group to a common one

Question

I need to give full access to user1 and user2 to this directory:

drwxr-xr-- 3 oracle dba   4096 feb  9 23:16 scripts

I can't change directoy group because probably that group is needed for other users to access the directory and I can't add user1 and user2 to dba group because in this case I will give too much privileges to these users.

I know I can use ACLs but, are ACLs a good practice? I think that using ACLs introduce a lot of chaos and you lose the control.

Another thing I have though is to create a new group and add all users in dba group to this new group and then change directory group to this new group, would this guarantee that all users that had access to this directory will continue to have access?

What would be the best practice to give these two users full access to this directory without removing permissions from other already existent users?

Answer 1

I think that using ACLs introduce a lot of chaos and you lose the control.

I don't think so. (I'm backing up my statement with as much evidence as you did yours.)

If you have a problem that calls for ACLs, use ACLs.

Here, the key question is: if a new user is added to the dba group, will they need to get access to the scripts directory?

• If the answer is yes, then the set of users who should have access to scripts should mention the dba group by reference. Hence the directory should have an ACL that allows access to the dba group as well as to the users user1 and user2. It would probably be cleaner to define a second group of “DB scripters” containing user1 and user2, and setting an ACL on scripts that allows access to the “DB scripters” group.
• If the answer is no, then the set of users who should have access to scripts is not related to the dba group. In this case you should create a “DB scripters” group that contains user1 and user2 as well as all the current DBAs (but not the future DBAs who shouldn't have access to that file).

In this scenario, it's likely that the answer is yes and therefore ACLs are exactly the right tool for the job.

Changing the ACL on a file takes effect immediately, just like traditional permissions. Adding a user to a group takes effect the next time they log in.