A program can access a file if any of the following is true for that file as well as any directories that need to be traversed:
- the user that the program is running as has access;
- any of the groups that the program is running as has access;
- everybody has access.
(This is actually not true in all cases but it's a good enough approximation here.)
Note that which users are members of which groups does not come up. This information is only used when a user logs in: it causes the programs in that login session to run as those groups. Thus adding a user to a group cannot solve your problem.
You need to give the user rslsync
access to the resilio
directory as well as the whole directory chain leading there. To access /home/liam/sync/resilio
, the program needs the directory traversal permission (x
attribute, which means “execute” for regular files) on /
, /home
, /home/liam
, /home/liam/sync
and /home/liam/sync/resilio
, as well as the read permission on /home/liam/sync/resilio
.
You can do that with an access control list:
setfacl -m u:rslsync:x /home/liam /home/liam/sync
setfacl -R -m u:rslsync:rx /home/liam/sync/resilio
setfacl -R -d -m u:rslsync:rx /home/liam/sync/resilio
The first line ensures that rslsync can traverse the leading directories.
The second line gives rslsync access to the whole directory tree rooted at /home/liam/sync/resilio
. The third line with the -d
flag sets the default ACL for newly created files — without this, rslsync would not be able to read any newly created file.
Some applications may create files with a more restrictive ACL than the default ACL. This can especially happen when files are copied from another location. In this case rslsync wouldn't be able to read those files. There's a different approach that ensures that rslsync can always read the files, which is to create an alternative view of the tree at /home/liam/sync/resilio
with different permissions. You can do that with bindfs. Note that you have to do the mounting as root to allow another user to access a bindfs filesystem. You can use the following line in /etc/fstab
:
bindfs#/home/liam/sync/resilio /var/lib/rslsync/resilio fuse ro,force-user=rslsync,perms=u+rD:go=