Two Groups Separate Permissions, One Directory?

Question

New to this and will try to make it as easy as possible. I have an IT group, and a Marketing group. I want both groups to have access to the same directory (which is Retail). What I want to do is give IT full control of Retail, and Marketing read/write.

If I am to use sudo chmod, I will end up giving the two groups the same permissions. Is there another way to go about this, or is it even possible to give separate groups different permissions belonging to the same directory?

Answer 1

You probably need ACL (Access Control Lists) on the directory. See those explanations from Arch Linux's wiki or those from Ubuntu's help. From a mix of both :

1. Installation : The acl package is a dependency of systemd, it should already be installed. It may be necessary to install acl utilities from the repositories. In the Server Edition, this must be done, but in the desktop editions acl is installed by default.

   $ sudo apt-get install acl
   

2. Enable ACL : The filesystem must be mounted with the acl option. You can use fstab to make it permanent on your system. Use the following command to check ext* formatted partitions for the option :

   # tune2fs -l /dev/sdXY | grep "Default mount options:
   

   Default mount options: user_xattr acl

   if needed, then add the option acl to the partition(s) on which you want to enable ACL in /etc/fstab. For example:

   ...
   UUID=07aebd28-24e3-cf19-e37d-1af9a23a45d4  /home  ext4  defaults,acl  0  2
   ...
   

   If necessary, remount partition(s) on which ACLs were enabled for them to take effect. For example:

   $ sudo mount -o remount /home
   

3. Set ACL : To set permissions for a group (group is either the group name or ID):

   # setfacl -m "g:group:permissions" <file/dir>
   

4. Show ACL :

   # getfacl <file/dir>
   

Answer 2

Sorry, I should have just said rwx for IT and rw only for Marketing

While you could do that with ACLs, it wouldn't be very useful.

You need the x permission to access any files inside the directory so rw- doesn't mean much. With just r (without x), you can list the names of the files in the directory (but possibly not their owners, sizes etc.), and w without x is completely useless.

Also note that creating and deleting files is controlled by the w permission on the directory, and that the owner of the file does not matter there. The exception is when the "sticky-bit" (chmod +t) is set on the directory, in which case users can only delete files they own.

If you're looking for something above that, like the possibility to handle other users' files regardless of their permissions, there isn't one, other than being root.

See:

• Execute vs Read bit. How do directory permissions in Linux work?
• Linux local directory permissions as question-marks for non-root

_{(Technically, it's not about being root, but the process having the particular capability that allows bypassing access permissions. But it can't be set on a per-directory basis, so any process with that capability is effectively root anyway.)}

Answer 3

First option is to use extended ACLs. I'm not a fan of this. I've seen longer problem solving times because of extended ACLs and I find them in general not very manageable. Proponents may disagree and point out that they work perfectly for these kind of requirements. But I doubt that they've been called in at 3 am to solve problems.

You need to understand what kind of access is needed. In standard Unix/Linux, there is

Type of access       For directory         For files
r   Read access      can list the dir      can read the file

w   write access     can create, remove    can write to the file
                      rename files in
                      the dir

x  execute           can cd to the dir     can execute the file as 
                                           program

If you look at Windows full control, that means

• read
• write
• modify
• execute
• change attributes/permissions
• take ownership

Modify is a container of other permissions (read, write, modify, execute, and change the file’s attributes), so we won't look at that.

Read and write should be given to both groups, so that should not be a discussion about that. If your groups need to do anything in the directory, they'll both need x as well.

Changing permissions on the files is possible with write access to the directory, which was granted. Most of the changeable attributes (name, timestamp) can also be changed with the write on the directory. But these should not be a problem.

Changing ownership of a file requires root access (possibly via sudo). This is not something that you grant to normal users.

So, that means that there is no real difference between the normal access that the two groups have (except that you might allow the it-staff to sudo chown).

And that also means that you do not need the complexity of ACLs.