0

I'm trying to add a user to have permission to access a particular directory on a linux filesystem.

I saw this answer here: https://superuser.com/questions/235297/allow-specific-user-permission-to-read-write-my-folder, and ran:

setfacl -m user:tom:rwx /home/to/folder

However, when I run ls -l the user is not shown as having access to the directory, and I cannot access it as that user.

Is there another way to add a particular user to the directory? I don't want to add the user as the owner of the directory, or add the user to the owner group as this would affect that users' access across the entire system.

Any help would be greatly appreciated!

  • 1
    What happens when you "cannot access it"? Do you have ACL support enabled for the filesystem? Did setfacl succeed? ls isn't going to show anything regardless. You can edit your question. – Michael Homer Apr 10 '18 at 1:43
0

ACL entries still follow the same rules regarding access that primary attributes do. Remember that the user needs at least r-x to be able to list the files and change to the directory, and at least r-- to be able to read the files. If you don't actually give them permissions to the files, they won't be able to open anything. As well, if the user doesn't have at least --x permissions (preferably r-x) to the intermediate directories, they won't be able to traverse to the directory location.

There are two places where you have to look when you are determining access rights. Given the following example:

drwxrwx---+  5 DOMAIN\erik     DOMAIN\domain users    4096 Apr 11  2017  documents
  • The primary attributes: these are what you see when you run ls -l. Only one user and group can be specified here (there's no room to put more!), which is why you don't see any other users.
  • The ACL (access control list): there are additional users and groups who have permissions beyond the primary attributes. They are indicated with a + after the permissions and can be seen by running getfacl (this is from a Samba-shared directory):

    $ getfacl directory
    # file: directory
    # owner: DOMAIN\134erik
    # group: DOMAIN\134domain\040users
    user::rwx
    user:DOMAIN\134erik:rwx
    group::r-x
    group:DOMAIN\134domain\040users:r-x
    group:DOMAIN\134test\040group:rwx
    mask::rwx
    other::---
    default:user::rwx
    default:user:DOMAIN\134erik:rwx
    default:group::r-x
    default:group:DOMAIN\134domain\040users:r-x
    default:mask::rwx
    default:other::---
    

    (Directories will have default entries; files won't.)

    As you can see, the ACL allows for many entries and you can indicate what the default attributes (for new files and directories) are; additionally, getfacl shows the primary attributes as comments at the top.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.