A program can access a file if any of the following is true for that file as well as any directories that need to be traversed:
- the user that the program is running as has access;
- any of the groups that the program is running as has access;
- everybody has access.
(This is actually not true in all cases but it's a good enough approximation here.)
Note that which users are members of which groups does not come up. This information is only used when a user logs in: it causes the programs in that login session to run as those groups. Thus adding a user to a group cannot solve your problem.
You need to give the user
rslsync access to the
resilio directory as well as the whole directory chain leading there. To access
/home/liam/sync/resilio, the program needs the directory traversal permission (
x attribute, which means “execute” for regular files) on
/home/liam/sync/resilio, as well as the read permission on
You can do that with an access control list:
setfacl -m u:rslsync:x /home/liam /home/liam/sync
setfacl -R -m u:rslsync:rx /home/liam/sync/resilio
setfacl -R -d -m u:rslsync:rx /home/liam/sync/resilio
The first line ensures that rslsync can traverse the leading directories.
The second line gives rslsync access to the whole directory tree rooted at
/home/liam/sync/resilio. The third line with the
-d flag sets the default ACL for newly created files — without this, rslsync would not be able to read any newly created file.
Some applications may create files with a more restrictive ACL than the default ACL. This can especially happen when files are copied from another location. In this case rslsync wouldn't be able to read those files. There's a different approach that ensures that rslsync can always read the files, which is to create an alternative view of the tree at
/home/liam/sync/resilio with different permissions. You can do that with bindfs. Note that you have to do the mounting as root to allow another user to access a bindfs filesystem. You can use the following line in
bindfs#/home/liam/sync/resilio /var/lib/rslsync/resilio fuse ro,force-user=rslsync,perms=u+rD:go=