1

I am working in my Tomcat deployment directory. The files in the directory have the permission:

drwxrwsr-x. 10 tomcat www  4.0K Mar 15 15:14 webapps  

A sample sub-directory within webapps looks like this:

drwxr-sr-x.  6 tomcat www 4.0K Mar 15 15:19 oldApps

While I am a member of group www, I am able to create directories in oldApps. This is despite the group www having no write permissions on oldApps.

I have a line in my sudoers file that allows mkdir to members of www group. I am not able to understand how I can write to the folder oldApps without any write permissions on the folder.

Update:
Ok, I get that I might be running the mkdir command as root, thus allowing me to create folders. How do I remove the line from sudoers and still be able to create directories?

0

You actually answered your own question: The reason you can create a subdirectory where your group has no write permissions, is because you have a line in your sudoers file that allows mkdir to members of your group.

Perhaps you are confused about the purpose of the sudoers file and the sudo command: You don't need to explicitly allow every command that you intend for someone to run; in fact you shouldn't do this.

sudo is for running privileged commands. You should only give someone sudo access for commands that you wish them to be able to run as root. With full sudo access for any command, the user can do anything, regardless of the permissions settings of individual files and directories.

| improve this answer | |
  • Agreed. I figured I was running the mkdir command as root. How do I get the ability to run mkdir on www if I did not have the entry in the sudoers file – Sriram Mar 15 '16 at 10:15
  • @Sriram, chmod g+x oldApps, you mean? Not sure I get the question. – Wildcard Mar 15 '16 at 10:37
  • I meant if I remove the entry in the sudoers file, I cannot create the directory. How do I remove the sudoers entry and still create the sub-directory? – Sriram Mar 15 '16 at 10:55
  • @Sriram, the most straightforward way would be to give your group write permissions on that directory, unless you have some reason not to. chmod g+w oldApps (my last comment had a typo, sorry.) – Wildcard Mar 15 '16 at 11:03
  • This did not work. I am not able to delete any sub-directory of oldApps - with sudo or without. – Sriram Mar 15 '16 at 12:01
0

The reason that you can create the directory is due to the fact you are using sudo. The actual mkdir command runs (most probably) as tomcat. Since the set-gid attribute is set the group on the new directory is still www

Update:

To add permissions to another user and/or group you can use extended ACLs:

setfacl -d -m g:www:rwx oldApps
setfacl -m g:www:rwx oldApps
| improve this answer | |
  • Thanks for your reply. I have updated the question. I realize that making changes to sudoers is not ideal. How do I create a directory without a line in sudoers? – Sriram Mar 15 '16 at 10:17
  • You might use extended ACLs, see updated answer. – Lambert Mar 15 '16 at 10:23
  • I tried both commands as you suggested, but the I am still unable to delete any files/folders within oldApps. – Sriram Mar 15 '16 at 12:03
  • For existing directories you may need to set the extended ACLs recursively. See man setfacl and search for 'recursive' – Lambert Mar 15 '16 at 12:08
  • The /etc/fstab entry does not have an acl in the options taken while mounting. Could that also be a reason why this is not mounting correctly? Do I need to remount with acl options set? – Sriram Mar 15 '16 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.