I've been trying to figure out a good permissions scheme for my multi-user file server. I currently have about 5 users, each storing files in their home directory. These files are also being accessed by various applications on the machine, such as a web server running ownCloud, and the BitTorrent Sync application. These applications each run under their own user account. I'm looking for a permissions scheme to achieve the following:
-No user should be able to access another user's home directory (except possibly me, as the admin)
-The application user accounts should have full access to all of the user accounts (we'll assume that user access isolation is implemented properly within the applications themselves, or else this would violate rule 1)
-Files created by the application user accounts should still be accessible by the user under whose home directory they were created
Right now, the best I've been able to come up with is to add all of the applications to the www group, and then create the user home directories as :www 770, but this really doesn't seem like a good solution. Another idea I had was to use the user-specific groups (i.e. the groups with the same name as the users), and then create the home directory as : 770, and then add the application username to each user's group separately. Also, there's the possibility of using sticky-bits, but I'm not really sure how those work. I should probably specify this is a FreeNAS server, as I understand sticky-bits work a bit differently on BSD vs Linux.
Any thoughts? As a native Windows user, this is one of those things that I could have done in 5 minutes with ACL's, but c'est la vie...