I am working in my Tomcat deployment directory. The files in the directory have the permission:

drwxrwsr-x. 10 tomcat www  4.0K Mar 15 15:14 webapps  

A sample sub-directory within webapps looks like this:

drwxr-sr-x.  6 tomcat www 4.0K Mar 15 15:19 oldApps

While I am a member of group www, I am able to create directories in oldApps. This is despite the group www having no write permissions on oldApps.

I have a line in my sudoers file that allows mkdir to members of www group. I am not able to understand how I can write to the folder oldApps without any write permissions on the folder.

Ok, I get that I might be running the mkdir command as root, thus allowing me to create folders. How do I remove the line from sudoers and still be able to create directories?

2 Answers 2


You actually answered your own question: The reason you can create a subdirectory where your group has no write permissions, is because you have a line in your sudoers file that allows mkdir to members of your group.

Perhaps you are confused about the purpose of the sudoers file and the sudo command: You don't need to explicitly allow every command that you intend for someone to run; in fact you shouldn't do this.

sudo is for running privileged commands. You should only give someone sudo access for commands that you wish them to be able to run as root. With full sudo access for any command, the user can do anything, regardless of the permissions settings of individual files and directories.

  • Agreed. I figured I was running the mkdir command as root. How do I get the ability to run mkdir on www if I did not have the entry in the sudoers file
    – Sriram
    Mar 15, 2016 at 10:15
  • @Sriram, chmod g+x oldApps, you mean? Not sure I get the question.
    – Wildcard
    Mar 15, 2016 at 10:37
  • I meant if I remove the entry in the sudoers file, I cannot create the directory. How do I remove the sudoers entry and still create the sub-directory?
    – Sriram
    Mar 15, 2016 at 10:55
  • @Sriram, the most straightforward way would be to give your group write permissions on that directory, unless you have some reason not to. chmod g+w oldApps (my last comment had a typo, sorry.)
    – Wildcard
    Mar 15, 2016 at 11:03
  • This did not work. I am not able to delete any sub-directory of oldApps - with sudo or without.
    – Sriram
    Mar 15, 2016 at 12:01

The reason that you can create the directory is due to the fact you are using sudo. The actual mkdir command runs (most probably) as tomcat. Since the set-gid attribute is set the group on the new directory is still www


To add permissions to another user and/or group you can use extended ACLs:

setfacl -d -m g:www:rwx oldApps
setfacl -m g:www:rwx oldApps
  • Thanks for your reply. I have updated the question. I realize that making changes to sudoers is not ideal. How do I create a directory without a line in sudoers?
    – Sriram
    Mar 15, 2016 at 10:17
  • You might use extended ACLs, see updated answer.
    – Lambert
    Mar 15, 2016 at 10:23
  • I tried both commands as you suggested, but the I am still unable to delete any files/folders within oldApps.
    – Sriram
    Mar 15, 2016 at 12:03
  • For existing directories you may need to set the extended ACLs recursively. See man setfacl and search for 'recursive'
    – Lambert
    Mar 15, 2016 at 12:08
  • The /etc/fstab entry does not have an acl in the options taken while mounting. Could that also be a reason why this is not mounting correctly? Do I need to remount with acl options set?
    – Sriram
    Mar 15, 2016 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .