Add a user to have permission for a particular directory in linux

Question

I'm trying to add a user to have permission to access a particular directory on a linux filesystem.

I saw this answer here: https://superuser.com/questions/235297/allow-specific-user-permission-to-read-write-my-folder, and ran:

setfacl -m user:tom:rwx /home/to/folder

However, when I run ls -l the user is not shown as having access to the directory, and I cannot access it as that user.

Is there another way to add a particular user to the directory? I don't want to add the user as the owner of the directory, or add the user to the owner group as this would affect that users' access across the entire system.

Any help would be greatly appreciated!

Answer 1

ACL entries still follow the same rules regarding access that primary attributes do. Remember that the user needs at least r-x to be able to list the files and change to the directory, and at least r-- to be able to read the files. If you don't actually give them permissions to the files, they won't be able to open anything. As well, if the user doesn't have at least --x permissions (preferably r-x) to the intermediate directories, they won't be able to traverse to the directory location.

There are two places where you have to look when you are determining access rights. Given the following example:

drwxrwx---+  5 DOMAIN\erik     DOMAIN\domain users    4096 Apr 11  2017  documents

• The primary attributes: these are what you see when you run ls -l. Only one user and group can be specified here (there's no room to put more!), which is why you don't see any other users.

• The ACL (access control list): there are additional users and groups who have permissions beyond the primary attributes. They are indicated with a + after the permissions and can be seen by running getfacl (this is from a Samba-shared directory):

  $ getfacl directory
  # file: directory
  # owner: DOMAIN\134erik
  # group: DOMAIN\134domain\040users
  user::rwx
  user:DOMAIN\134erik:rwx
  group::r-x
  group:DOMAIN\134domain\040users:r-x
  group:DOMAIN\134test\040group:rwx
  mask::rwx
  other::---
  default:user::rwx
  default:user:DOMAIN\134erik:rwx
  default:group::r-x
  default:group:DOMAIN\134domain\040users:r-x
  default:mask::rwx
  default:other::---
  

  (Directories will have default entries; files won't.)

  As you can see, the ACL allows for many entries and you can indicate what the default attributes (for new files and directories) are; additionally, getfacl shows the primary attributes as comments at the top.