2

I have a directory say /data and 3 users - user1, user2, user3

each user has a folder in /data

[root@localhost ~]# ls -lrt /data
total 64
drwx------.  2 root        root        16384 May 19  2017 lost+found
drwx------.  2 user1       user1        4096 Jun  7  2017 user1
drwx------.  3 user2       user2        4096 Jun 12  2017 user2
drwx------.  2 user3       user3        4096 Jul 16  2017 user3

How do I set permissions so that when user1 logs in and cd's into /data and does a ls -lrt or maybe logs in via winscp or any random ftp/sftp software, they would be able to list only "user1" directory and the rest of the directories are invisible to him.

eg. should be visible as below

[user1@localhost ~]$ ls -lrt /data
total ??
drwx------.  2 user1       user1        4096 Jun  7  2017 user1
[user1@localhost ~]$
3

This cannot be done. But you can set the permissions on /data to --x for others, so they can only (blindly) cd into their directory but not see the contents of /data at all:

# chmod 771 /data
  • One could do it (I think) if the main directory is located on an NFS server and the clients automounted from it. – Kusalananda Jun 30 '18 at 12:16
  • @Kusalananda The directory where server:/data is mounted would still have to be executable so that the users would be able to traverse it to get into the respective user directories. Whether it's that way or the way in ctrl-d's answer, the user's wouldn't be able to ls-l from inside of /data and list the directories that they don't own but they'd be able to directly ls -l /data/user# if they knew that the directory was there and the name of it. With that being said, it is possible but it just doesn't cover every scenario. – Nasir Riley Jun 30 '18 at 14:49
-1

This is not possible using traditional mode permissions in Unix. This is due to the fact that the permissions to read a directory are required to read the contents of said directory.

Example

I'm going to use the su command to illustrate why. I've set up 3 user accounts, user1, user2, and user3.

$ su -c 'whoami' user1
user1
$ su -c 'whoami' user2
user2
$ su -c 'whoami' user3
user3

Here's my directory structure:

$ mkdir -p /data/user{1..3}
$ for i in {1..3};do chown user${i}:user${i} /data/user${i};done

$ ls -l /data/
total 12
drwxr-xr-x 2 user1 user1 4096 Jun 30 11:35 user1
drwxr-xr-x 2 user2 user2 4096 Jun 30 11:35 user2
drwxr-xr-x 2 user3 user3 4096 Jun 30 11:35 user3

If we set the permissions such that no user can read the /data then no user can do a ls -l /data.

$ chmod 750 /data

$ su -c 'ls -l /data' user1
ls: cannot open directory /data/: Permission denied

In order to allow a user that's not the owner (root) or in the group (root), we have to enable the r-x permissions for anyone (ie. the other permissions).

If we just enabled the r-- permissions the user's could list some aspects of the directory but not acquire things such as the permissions of the contents within the directory.

$ chmod 754 /data

$ su -c 'ls -l /data/' user1
ls: cannot access /data/user3: Permission denied
ls: cannot access /data/user2: Permission denied
ls: cannot access /data/user1: Permission denied
total 0
d????????? ? ? ? ?            ? user1
d????????? ? ? ? ?            ? user2
d????????? ? ? ? ?            ? user3

If we try and give user's just execute permissions, --x, they can access the sub-directories of /data but cannot perform any listing of the contents of /data.

$ chmod 755 /data

$ su -c 'ls -l /data/' user1
total 12
drwxr-xr-x 2 user1 user1 4096 Jun 30 11:35 user1
drwxr-xr-x 2 user2 user2 4096 Jun 30 11:35 user2
drwxr-xr-x 2 user3 user3 4096 Jun 30 11:35 user3

What about ACLs?

Could using access control lists (ACLs) work here? In investigating this I don't think they can give you anything better.

Here I'm resetting the permissions to 750 on /data, and added an ACL for user1 to /data or --x:

$ chmod 750 /data
$ setfacl -m u:user1:x /data

$ ls -ld /data
drwxr-x---+ 5 root root 4096 Jun 30 11:35 /data

Our user, user1, is now no longer able to access /data:

$ su -c 'ls -l /data' user1
ls: cannot open directory /data: Permission denied

But can still see the sub-dir /data/user1:

$ su -c 'ls -l /data/user1' user1
total 0    

This is the effect the setfacl had on permissions:

    $ getfacl /data
    # file: data
    # owner: root
    # group: root
    user::rwx
    user:user1:--x
    group::r-x
    mask::r-x
    other::---

What's the issue?

The problem is that in order to have access to list the contents of a directory, mainly /data, user's need r-- permissions to do this. We cannot explicitly give out 'portions' of this, it's all or nothing in the world of mode permissions in Unix.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.