Can I share a folder inside my home directory with another user?

Question

Can I share a folder inside my home directory with another user?

I have two users on a system, agent and daemon. An external server connects as agent and rsyncs files to ~agent/incoming

I want daemon to have access to the files in ~agent/incoming but I don't want agent to have access to any of daemon's files.

I set up a group called automaton and added both users to it. I then chmod'ed the ~agent/incoming folder to drwxrws--- (notice the sticky bit) and chowned that folder to agent:automaton.

The process runs and new files are delivered to the incoming folder and are set as agent:automaton with permissions -rw-rw---- but daemon is not able to view or copy these files:

stat: cannot stat (path here) : Permission denied

What am I doing wrong?

Answer 1

Your question is difficult to answer precisely because you haven't said what path you're passing to the daemon and you haven't specified the permissions of ~agent. If you start the daemon in the ~agent/incoming directory and pass it relative paths, then since the daemon is in the automaton group it will be able to read, write and delete the files in the ~agent/incoming directory.

I guess what's happening is:

1. The ~agent directory is not executable to the daemon.
2. The path passed to the daemon includes ~agent as a component (say, it's an absolute path).

When a process accesses /home/agent/incoming/foo, it must have execution permissions on all the directories that are traversed: /, /home, /home/agent and /home/agent/incoming (more if some of these are symbolic links).

If the daemon accesses foo while its current directory is ~agent/incoming, it only needs to have execution permissions on the current directory (~agent/incoming) itself. You need to manage to make that directory current; chdir requires that the process have access to the target directory. This is possible if you first change to the desired directory while running as (say) the agent user, then run something like su daemon -c daemon-command.

Answer 2

there is no permission for daemon in '~agent/' folder eventhough he has permission for '~agent/incoming' so it is hierarchy of permissions see this A question about permissions of hierarchical directories