I have following files:

----rw---- 1 wojtek users    4 Oct 26 15:56 data.txt
-rwx--s--x 1 wojtek users 8864 Oct 26 16:00 fopen_setgid

When I run fopen_setgid

  • as daro then everything works as expected: The program runs with the users group permission (instead of the daro group) so there is no error
  • as wojtek then I receive the error Permission denied but I don't know why. Shouldn't it run the program with the users group permission instead of the wojtek group allowing the program to to successfully open the file like in the daro case?

The only thing that fopen_setgid does is to open data.txt

  • The user daro is only in 1 group: daro

  • The user wojtek is only 1 group: wojtek

  • The group users has no members

My OS is Debian 9 (stretch)

  • what's fopen_setgid? What is it supposed to do? The only hit for it on google is this question... – ilkkachu Nov 5 '19 at 15:58

I didn't find a reference, but I just tested it. The issue is not related to setgid but depends only on the UID, GID of the process and the file and the file permissions.

I created a file

echo test > test.txt

changed the permissions

chmod 064 test.txt

and can no longer access it

$ cat test.txt
cat: test.txt: Permission denied

although my group has rw access.

$ ls -l test.txt
----rw-r-- 1 myuser myuser 5 Nov  5 16:11 test.txt
$ id
uid=1000(myuser) gid=1000(myuser) groups=1000(myuser),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),118(lpadmin),129(sambashare)

Then I changed the file owner to root and can successfully open the file.

$ sudo chown root test.txt 
$ ls -l test.txt
----rw-r-- 1 root myuser 5 Nov  5 16:11 test.txt
$ cat test.txt            

Apparently the owner access bits take precedence over the group access bits if both user and group match. (tested on Ubuntu 19.04)

So the workaround is to add u+rw permissions for the file or change the file owner to something else, not wojtek or daro.

  • So when wojtek is the owner and logged user is wojtek the system only look for a owner bits never looking for a group field when checking for a access rights? – Spectre911 Nov 5 '19 at 21:17
  • @Spectre911 This is what I observed in my test. Unfortunately I did not (yet) find a documentation of this behavior. – Bodo Nov 6 '19 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.