First option is to use extended ACLs. I'm not a fan of this. I've seen longer problem solving times because of extended ACLs and I find them in general not very manageable. Proponents may disagree and point out that they work perfectly for these kind of requirements. But I doubt that they've been called in at 3 am to solve problems.
You need to understand what kind of access is needed. In standard Unix/Linux, there is
Type of access For directory For files
r Read access can list the dir can read the file
w write access can create, remove can write to the file
rename files in
x execute can cd to the dir can execute the file as
If you look at Windows full control, that means
- change attributes/permissions
- take ownership
Modify is a container of other permissions (read, write, modify, execute, and change the file’s attributes), so we won't look at that.
Read and write should be given to both groups, so that should not be a discussion about that. If your groups need to do anything in the directory, they'll both need
x as well.
Changing permissions on the files is possible with write access to the directory, which was granted. Most of the changeable attributes (name, timestamp) can also be changed with the write on the directory. But these should not be a problem.
Changing ownership of a file requires root access (possibly via sudo). This is not something that you grant to normal users.
So, that means that there is no real difference between the normal access that the two groups have (except that you might allow the it-staff to
And that also means that you do not need the complexity of ACLs.