0

I set up mask like setfacl -R -d -m m::rw ., and it works fine on the local machine (that I am ssh'd in right now, its headless). I can have two users modify and read the directory. But when I am using sshfs to access one of the users to modify the directory, instead of effective set to rw-, it get set to r--. This does not happen if I am manually ssh'd in to the machine and sudo as the user to create a file. Though, I can create directories with sshfs and it works.

0

I came up with a bit of a hacky solution that uses inotify for the time being.

I coded a shell script that uses inotifywait from inotify-tools to wait for a file to be created, then when a file is created it will run my setfacl command to set up the shared directory, then find every subdirectory in my shared directory and mark that as executable (I only want directories to be executable, you can exclude that part if you want.)

Here is the script:

#!/bin/sh
while inotifywait -qqre create /share; do
    setfacl -R -m u:user2:rw /share
    for dir in $(tree /share); do
        setfacl -m u:user2rwx ${dir}
        setfacl -m u:user1:rwx ${dir}
    done
done

user2 is the user that is accessing the share through sshfs.

Requires inotify-tools and tree. You could probably do something with find instead of tree but I guessed tree to be easier.

I may add support with my external commands to chmod +x a file (I can't mark a file as executable as the other user) and log the files that wanted to be marked as executable and re-add the executable bit.

I haven't thoroughly tested in a production environment (seeing how programs behave if the file changes permission/can't-open while permissions) but from what I've seen it works fine.

I think the problem may be that it is getting the mask rules from my current system, but I'm not 100% sure. I can't change the acl of the sshfs directory from the remote system as root or the normal user so I can't change the mask permission from the remote system.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.