2

help with the question. There is a server on CentOS 7, it has a bunch of users, each has its own projects. Some users have subprojects on which other users work, the structure is approximately this: / home / user1 / {project1, project2} for project 1/2 owner user1: user1 / home / user2 {project1, project2}

What I want to do, but does not work: there is a permissible poduser1, which should work quietly (rwx) with project2 from user1, but the other projects of this user should be unavailable. To throw a user in one group is not good, too many rights get everything, tried through ACL - it's clumsy at all

  • Could make a limited group called {Project2}, set it as owner/access rights of the project directory and add related users to it. – Mioriin Nov 13 '17 at 12:03
  • well, and if such users and projects they have several dozen? Under each project do the group? – cyber01 Nov 13 '17 at 12:14
  • Maybe you should use git or some other version/access control system and let the users' /home directories stay as the users' own directories. – Mioriin Nov 13 '17 at 12:18
  • It's not completely clear to me what you're asking. It sounds like you're trying to accomplish a common task (setting up shared directories) but that you're averse to employing the standard tools used to accomplish that task (groups and ACLs). Maybe you can elaborate on what you want and clarify why those tools are insufficient? – igal Nov 13 '17 at 12:47
1

It's not totally clear to me what you're asking for, but it sounds like you want one user (user1) to be able to share certain subdirectories (e.g. /home/user1/project1) with other users (user2) without allowing them full access to their home directory (/home/user1). I think the standard way to accomplish this would be to create a project-specific group for that directory and then use ACLs (Access Control Lists) and the setgid bit in order to maintain the appropriate permissions and ownership for files in that directory. In your case you could probably execute the following commands:

groupadd project1

chown -R user1:project1 /home/user1/project1

chmod -R g+s /home/user1/project1

setfacl --default --modify group:project1:rwx /home/user1/project1

setfacl --modify group:project1:rwx /home/user1/project1

You would then add the desired user accounts to the project1 group, e.g.:

usermod -a -G project1 user2

A more detailed explanation follows.


Let's work through an example of how we could go around configuring the kind of setup you've described. All of these commands are executed as root.

First let's create a couple of users:

useradd -m user1
useradd -m user2

Next let's create a project directory in the first user's home directory:

sudo -u user1 mkdir /home/user1/project1

Now let's create a group associated with that project and set it as the group-owner for the project directory:

groupadd project1
chown -R user1:project1 /home/user1/project1

And let's add both users to that project's group:

usermod -a -G project1 user1
usermod -a -G project1 user2

Now let's set the default permissions for the project directory using an ACL (Access Control List):

setfacl --default --modify group:project1:rwx /home/user1/project1
setfacl --modify group:project1:rwx /home/user1/project1

And let's also turn on the setgid bit:

chmod -R g+s /home/user1/project1

At this point everything should be good to go. Let's check the permissions on the project directory:

root@host:~# ls -ld /home/user1/project1/

drwxrwsr-x+ 2 user1 project1 4096 Nov 13 12:20 /home/user1/project1/

root@host:~# getfacl /home/user1/project1

getfacl /home/user1/project1/
getfacl: Removing leading '/' from absolute path names
# file: home/user1/project1/
# owner: user1
# group: project1
# flags: -s-
user::rwx
group::r-x
group:project1:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:project1:rwx
default:mask::rwx
default:other::r-x

And let's test out the ability of user2 to write to the project directory:

root@host:~# sudo -u user2 touch /home/user1/project1/testing

root@host:~# ls -l /home/user1/project1/testing
-rw-rw-r--+ 1 user2 project1 0 Nov 13 12:20 /home/user1/project1/testing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.