11

So, I've been using Linux for a few years now, and I really should know this answer, but I'm having trouble finding it. Specifically I've been using Debian based distro's....mostly Ubuntu.

If I have a server, that has more than three users, how do I set a different set of permissions to a file for each user.

For example:

If I have a file with these permissions and ownership:

rwx rw_ r__ user1:group1 file1.txt

and I have 3 users with these desired permissions....

  • user1 rwx
  • user2 rw_
  • user3 r__

All I have to do is have user1 own the file, user2 be in group1, and user3 can be neither -- correct?

But, what if I have a user4 and user5.

  • user4 _wx
  • user5 __x

How would I set that up?

I haven't had to do this before, but I was asked that question by a Windows admin, and I honestly couldn't answer.

  • 8
    For that kind of granularity in permissions, you will need to utilize access control lists (ACLs) You can find a quick Tutorial here. Although a word of caution, once you start down the path of ACLs instead of permissions, it is a very slippery slope and things get complicated real fast with some unintended consequences at the end. – MelBurslan Jul 26 '16 at 14:35
19

Traditional unix permissions only allow user, group, other permissions as you've found. These can result in some awkward combination of groups needing to be created...

So a new form of ACL (Access Control Lists) were tacked on. This allows you to specify multiple users and multiple groups with different permissions. These are set with the setfacl command and read with getfacl

$ setfacl -m u:root:r-- file.txt
$ setfacl -m u:bin:-wx file.txt 
$ setfacl -m u:lp:--x file.txt 
$ getfacl file.txt
# file: file.txt
# owner: sweh
# group: sweh
user::rw-
user:root:r--
user:bin:-wx
user:lp:--x
group::r--
mask::rwx
other::r--

You can easily tell if a file has an ACL by looking at the ls output:

$ ls -l file.txt
-rw-rwxr--+ 1 sweh sweh 0 Jul 26 10:33 file.txt

The + at the end of the permissions indicates an ACL.

2

Yes, ACL:s allow freely setting different rights to different users or groups. IIRC the usual group permissions limit the set of permissions that groups and users can have through ACL:s (shown as mask in getfacl), but setfacl should deal with that if you add permissions.

But in some cases you need to ask if the set of permissions makes any sense.

I have 3 users with these desired permissions....
- user1 rwx
- user2 rw_
- user3 r__

You could implement this with ACL:s, or (approximately) with the usual Unix permissions by making user1 the owner of the file, user2 a member of the group, and let others, including user3 have read-access. Though then everyone (with access to the directory) would also have read-access.

Let's consider the meaning of those permissions. You have one user that can read, and another that can read and write. That's completely usual. Neither of these have access to execute the file, but then a third user is supposed to be able to do that, too.

That doesn't make much sense in my mind. Any user who can read the file, can make a copy(*), mark it executable, and run it, without access to execute the original file. The only situation it makes sense to have execute access for some users but not for others, is when the executable has elevated privileges through suid. But if that were the case, you shouldn't have other users with write access to the file, either.

In the same sense, user4 with -wx and user5 with --x don't make sense to me. Write-only access might make sense if there was a possibility of only allowing appends, but the permission system isn't that fine-grained.

(* unless they can't write anywhere)


Though, if we remove the weird requirement for the x bit, we're left with a file where user1 and user2 should have write access, and user3 should have read access. One writer and multiple readers would be easy with the traditional model, but this case would need tricks to combine the file permissions with the permissons of the containing directory. Luckily, in many cases one user with more permissions is sufficient.

Without the requirement on the execute bit, this looks like a case to use ACL:s. But with it, this particular example seems rather convoluted to me.

  • If the user can only write to a file system mounted without execute permission, he cannot execute a copy, even if he could execute the original if the appropriate permissions would be set. Also execute-only might make sense if you want to prevent them from looking for exploits. -wx is definitely strange, though. – celtschk Jul 26 '16 at 17:46
  • 1
    Some systems have a mechanism of allowing only appends. Linux has chattr +a, for instance. And even without anything system-specific, you could make the file a FIFO. --x, and by extension also -wx, makes sense to me for directories. – Random832 Jul 26 '16 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.