Automatically change file permission upon write to a folder

Question

How can I create directories so:

/data
/data/user1
/data/user2

and make sure that whenever root writes inside them, depending on which directory it writes to, different owners are set.

Example:

1. Root writes to /data -> normal file creation
2. Root writes to /data/user1 -> any files created therein are automatically owned by user1 and readable by others (the same should apply if user1 writes to the dir himself)

Answer 1

You can get something close to what you want using the SGID bit on the directories. If you run

chmod g+s /data/user1

Then any file or directory created in that directory will have the group ownership set to be the same group as that of the directory itself. It doesn't achieve precisely what you want but it gets you part of the way there.

Another way to do this is to use POSIX acls and set default acls on the directories. Default acls will be inherited by files created in the directories. They don't change ownership but they do offer a way to give read, write or execute access to arbitrary groups beyond the three basic groups of standard file acls.

Answer 2

The script below can be pretty dangerous, and only monitor new files created in ${DIR}, owner of any file created will be changed to ${OWNER}, and add global read permission.

Use it at your own risk ...

#!/bin/bash

DIR="$PWD/user1"
OWNER="user1"

inotifywait -m --format "%e %f" "$DIR" | awk '$1 ~ "CREATE" { print $2; fflush() }' | 
while read file
do
    FILE="${DIR}"/"${file}"
    echo "Changin permission for ${FILE}"
    chown user1 "${FILE}"
    chmod o+r "${FILE}"
done

It would be more secure if you wrote a fs driver and mount it.

Answer 3

bindfs may do the trick for you

cd /data
chown user1:user1 user1
bindfs --create-for-user=user1 --create-for-group=user1 --create-with-perms=go+rD user1 user1

See the rest of bindfs man page for more things like chown/chmod policies.

Answer 4

You can't.

That's a job for either:

1. cron & chown
2. inotify & some scripting on your side.

Personally I'd go w/ inotify. The script above is a good starting point.