Unix restrict user to list only user owned files in a directory

Question

I have a directory say /data and 3 users - user1, user2, user3

each user has a folder in /data

[root@localhost ~]# ls -lrt /data
total 64
drwx------.  2 root        root        16384 May 19  2017 lost+found
drwx------.  2 user1       user1        4096 Jun  7  2017 user1
drwx------.  3 user2       user2        4096 Jun 12  2017 user2
drwx------.  2 user3       user3        4096 Jul 16  2017 user3

How do I set permissions so that when user1 logs in and cd's into /data and does a ls -lrt or maybe logs in via winscp or any random ftp/sftp software, they would be able to list only "user1" directory and the rest of the directories are invisible to him.

eg. should be visible as below

[user1@localhost ~]$ ls -lrt /data
total ??
drwx------.  2 user1       user1        4096 Jun  7  2017 user1
[user1@localhost ~]$

Answer 1

This cannot be done. But you can set the permissions on /data to --x for others, so they can only (blindly) cd into their directory but not see the contents of /data at all:

# chmod 771 /data

Answer 2

This is not possible using traditional mode permissions in Unix. This is due to the fact that the permissions to read a directory are required to read the contents of said directory.

Example

I'm going to use the su command to illustrate why. I've set up 3 user accounts, user1, user2, and user3.

$ su -c 'whoami' user1
user1
$ su -c 'whoami' user2
user2
$ su -c 'whoami' user3
user3

Here's my directory structure:

$ mkdir -p /data/user{1..3}
$ for i in {1..3};do chown user${i}:user${i} /data/user${i};done

$ ls -l /data/
total 12
drwxr-xr-x 2 user1 user1 4096 Jun 30 11:35 user1
drwxr-xr-x 2 user2 user2 4096 Jun 30 11:35 user2
drwxr-xr-x 2 user3 user3 4096 Jun 30 11:35 user3

If we set the permissions such that no user can read the /data then no user can do a ls -l /data.

$ chmod 750 /data

$ su -c 'ls -l /data' user1
ls: cannot open directory /data/: Permission denied

In order to allow a user that's not the owner (root) or in the group (root), we have to enable the r-x permissions for anyone (ie. the other permissions).

If we just enabled the r-- permissions the user's could list some aspects of the directory but not acquire things such as the permissions of the contents within the directory.

$ chmod 754 /data

$ su -c 'ls -l /data/' user1
ls: cannot access /data/user3: Permission denied
ls: cannot access /data/user2: Permission denied
ls: cannot access /data/user1: Permission denied
total 0
d????????? ? ? ? ?            ? user1
d????????? ? ? ? ?            ? user2
d????????? ? ? ? ?            ? user3

If we try and give user's just execute permissions, --x, they can access the sub-directories of /data but cannot perform any listing of the contents of /data.

$ chmod 755 /data

$ su -c 'ls -l /data/' user1
total 12
drwxr-xr-x 2 user1 user1 4096 Jun 30 11:35 user1
drwxr-xr-x 2 user2 user2 4096 Jun 30 11:35 user2
drwxr-xr-x 2 user3 user3 4096 Jun 30 11:35 user3

What about ACLs?

Could using access control lists (ACLs) work here? In investigating this I don't think they can give you anything better.

Here I'm resetting the permissions to 750 on /data, and added an ACL for user1 to /data or --x:

$ chmod 750 /data
$ setfacl -m u:user1:x /data

$ ls -ld /data
drwxr-x---+ 5 root root 4096 Jun 30 11:35 /data

Our user, user1, is now no longer able to access /data:

$ su -c 'ls -l /data' user1
ls: cannot open directory /data: Permission denied

But can still see the sub-dir /data/user1:

$ su -c 'ls -l /data/user1' user1
total 0    

This is the effect the setfacl had on permissions:

    $ getfacl /data
    # file: data
    # owner: root
    # group: root
    user::rwx
    user:user1:--x
    group::r-x
    mask::r-x
    other::---

What's the issue?

The problem is that in order to have access to list the contents of a directory, mainly /data, user's need r-- permissions to do this. We cannot explicitly give out 'portions' of this, it's all or nothing in the world of mode permissions in Unix.