2

I would like to create directory (Shared) in Linux and allow all users to create files in that Shared directory. Also Only users who creates files should be allowed to delete/modify their own files and rest of all users should limit to read-execute permission(705 or 755) in /Shared directory.

Example if user TOM creates file called 'sample' in Shared directory then User TOM should be owner of 'sample' file in /shared. User Jack and user Matt should be limited to read & execute permissions on that file 'sample' means permissions should be set up 755 on 'sample' file in /Shared directory. I would like to prevent rest of users editing and deleting files in shared directory which were created by user TOM. How can I achieve that?

Thanks, CG

0

3 Answers 3

2

From the comments, you are asking for regular files to automatically get execute permissions, and that is the hard part.

When a file is being opened for writing, using the system calls of open(2)/creat(2) family, the program must supply a mode parameter, which is used as a base value for setting the file permissions. This parameter is usually specified as mode 0666 in most programs that create regular files. Only programs that deliberately want to create executable files use mode 0777 as a base value.

The operating system will take this base mode value and the user's netmask setting, and perform a binary AND operation with them. Only the mode bits that are present in both the base mode value and the netmask value will be applied. The result is directly used as the chmod value for the resulting file. There is no mechanism that could add permissions the program calling for a file to be created did not request; the umask value can only restrict the permissions further.

For creating directories, a different mkdir(2) system call is used, and its permissions mechanism is exactly the same... but basically everyone uses a base mode value of 0777 when calling to create new directories.

POSIX ACLs use a similar mechanism for determining whether or not to assign execute permissions, so they won't help you grant execute permissions to all files by default either.

As far as I know, the only way to achieve what you want in Unix-style filesystems would be to rebuild every single program used by the users to use base mode 0777 when creating files. But then those programs would be creating files with execute permissions everywhere, not just in one particular directory.

But note that I said "Unix-style filesystems". A non-unix filesystem would have a fundamentally different way of handling file permissions. If you could use a NTFS filesystem for your special directory, maybe its native ACLs could enforce assigning execute permissions for files by default?

1

Those are the default permissions of the /tmp folder. So you can create the directory and then assign the permissions 1777:

mkdir /path/to/Shared
chmod 1777 /path/to/Shared

Then, to fine tune the permission on new files, you set the user permissions mask umask. For example, inside /tmp

rm /tmp/test
umask 011
touch /tmp/test
ls -l /tmp/test
-rw-rw-rw- 1 user user 0 nov 21 17:14 /tmp/test

with another mask:

rm /tmp/test
umask 022
touch /tmp/test
ls -l /tmp/test
-rw-r--r-- 1 user user 0 nov 21 17:15 /tmp/test

umask is global for the user. I don't know if that helps.

1
  • I did that already, but when User TOM created file, the file get created with -rw-rw--- permissions and I did "touch test" command & the test file permission are -rw-rw-r-- permissions. I wanted to see the file permissions in Shared directory -rwx-r-x-r-x or -rwx---r-x
    – user383043
    Nov 21, 2019 at 19:45
0

Most POSIX users don't understand basic permissions. You have OWNER/GROUP/OTHER roles each with 'rwx' permission, but only ONE of the three rwx sets applies to any one user or process. If you are OWNER then you cannot be GROUP or OTHER!! If a file permission are 007 it means that the owner and any user in the files group cannot access it - only non-owner_non-group-member=other!

Creating and deleting files in a directory refers to the directory permissions, and is unrelated to the file permissions. If you have directory write permission (based on one-of OWNER/GROUP/OTHER) then you can create and delete any file in that directory. [ Note that root has CAP_DAC_OVERRIDE capabilities, so can override these DAC permission limitations ].

Fortunately directories also have a sticky-bit permission, which allows only a files OWNER to delete (unlink) the file.

Your should create your directory as:

sudo mkdir somedir
sudo chmod 1707 somedir # set sticky bit

subdirectories that a user might create under somedir will typically (see umask) have 755 permission (OTHER can read and search, but not write the directory) and files created under such a sub-directory would have 544 permission, however the OWNER can choose to add execute permissions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .