I finally got to reinstalling my NAS/media-center and while at it I'm thinking about possible ways to improve security. There will be three users regularly using the NAS and that is me, gf, debian-deluge (dd from here on).
Now, I would like to make it that I can read/write everything. gf/dd can read everything, but write only into folders/files they created. The thing is I have no idea how to achieve that. I'm able to make it that each of users can write/read everything/everywhere. But this is what I would like (ownership in parentheses, groups are not mandatory and what they should be is probably part of this question):
/home/shared (probably me:me) | + movies (me:me) | + movie1 (me:me) | | + movie.avi (me:me) | + movie2 (gf:gf) | + movie.avi )(gf:gf) + torrents (dd:dd) + archlinux.iso (dd:dd) + ubuntu.iso (dd:dd)
Now, who can do what:
1. I can rename/create/read/write/delete everything everywhere 2. gf/dd can create any new folder/file anywhere that means she can for example download subtitles even into folder she doesn't own touch /home/shared/movies/movie1/movie.srt or create new folder mkdir /home/shared/kittens 3. gf/dd can rename/delete/read/write (into) any folder/file they own that means that gf can do (for example) mv /home/shared/movies/movie2 /home/shared/movies/movie3 rm -rf /home/shared/movies/movie3 but she cannot do none of mv /home/shared/movies/movie /home/shared/movies/movie3 rm /home/shared/movies/movie1/movie.avi
The issue I see is that I'm able to give other users read access to folder
rwxr-x--- which would allow read access, but not ability to create new
files. How can this be achieved, what am I missing?