Give user permission to folder in home directory

Question

I have just installed resilio sync and have it running fine. It creates a user 'rslsync' by default. I want to have the default folder that houses all of my sync items in my home directory which currently rslsync has no access to of course.

I have created a directory in my home directory called 'sync'. In the sync directory I have also created 2 folders 'dropbox' and 'resilio'. I would like the folder 'resilio' to be the default location for my files that resilio running as the 'rslsync' uses.

What is the best way to give user 'rslsync' read, write and execute access to the 'resilio' folder located in my home directory? Would simply adding user 'rslsync' to my user group give it all the access it needs?

Answer 1

A program can access a file if any of the following is true for that file as well as any directories that need to be traversed:

• the user that the program is running as has access;
• any of the groups that the program is running as has access;
• everybody has access.

(This is actually not true in all cases but it's a good enough approximation here.)

Note that which users are members of which groups does not come up. This information is only used when a user logs in: it causes the programs in that login session to run as those groups. Thus adding a user to a group cannot solve your problem.

You need to give the user rslsync access to the resilio directory as well as the whole directory chain leading there. To access /home/liam/sync/resilio, the program needs the directory traversal permission (x attribute, which means “execute” for regular files) on /, /home, /home/liam, /home/liam/sync and /home/liam/sync/resilio, as well as the read permission on /home/liam/sync/resilio.

You can do that with an access control list:

setfacl -m u:rslsync:x /home/liam /home/liam/sync
setfacl -R -m u:rslsync:rx /home/liam/sync/resilio
setfacl -R -d -m u:rslsync:rx /home/liam/sync/resilio

The first line ensures that rslsync can traverse the leading directories. The second line gives rslsync access to the whole directory tree rooted at /home/liam/sync/resilio. The third line with the -d flag sets the default ACL for newly created files — without this, rslsync would not be able to read any newly created file.

Some applications may create files with a more restrictive ACL than the default ACL. This can especially happen when files are copied from another location. In this case rslsync wouldn't be able to read those files. There's a different approach that ensures that rslsync can always read the files, which is to create an alternative view of the tree at /home/liam/sync/resilio with different permissions. You can do that with bindfs. Note that you have to do the mounting as root to allow another user to access a bindfs filesystem. You can use the following line in /etc/fstab:

bindfs#/home/liam/sync/resilio /var/lib/rslsync/resilio fuse ro,force-user=rslsync,perms=u+rD:go=

Answer 2

You can check the permissions, the owner and the group for each file and folder using the command ls -al.

For instance, you may get a response like this...

-rw-r--r-- 1 user user   148 Aug 26 10:58 a-file
drwxrwxrwx 0 user group  512 Aug 26 10:59 a-folder

Note the letters at the beginning of each row. These letters represents the permissions. Basically, each file and folder has permissions for the owner, the group and the others.

• the first letter, - or d, states if it is a file or a folder
• the following three letters, rwx give you information about the permissions for the owner user. r for read, w for write and x for execution or move to that folder.
• the next three letters represent permissions for the group. Note that a file may belong to a group different than the group of the owner.
• finally, the other three letters represent permissions for the others.

---

If you join 'rslsync' to the same group of the user, you may give it more permissions that you want. For instance, if the user belongs to an administrator group, you may give it permissions to run administration tasks or get access to private files.

To give user 'rslsync' full access (rwx) to the 'resilio' folder, you can assign the file to the rslsync group and give its group full access to the folder. If the rslsync group has the same name:

# change the group of the resilio folder
$ chgrp -R rslsync resilio

# set full access to the group
$ chmod -R g+rwx resilio

In such way, the user remains as the owner of the file, the 'rslsync' has full access to the folder and files and the groups remains separated one to the other.