I'm trying to share a folder between two users on the same machine . The normal way would be to have the two users in the same group set the parent folder to that group with rw and the s bit set.
That works great. Except .... the folder I am trying to share is one used by Chromium. When Chromium launches it writes some session files with only owner rw (i.e 600) permission ignroing the s bit. I guess some misbehaved programs can do that. That means when the other user tries later to open that same chromimum profile they can't set those sessions files cause they already exist with the owner only rw of the other user. :(
I gave bindfs a try but that requires sudo at login and thus I have to use a sudoers.d file if I want to get that set up non-interactive at login.
Anway I gave ACL a try and am not grokking some aspect because it's not working like I think it should.
# user1: syadmin # user2: david # directory: /opt/stest # user1 sysadmin is logged in. # sysadmin owns /opt/stest $ llag stest drwxrwsr-x+ 2 sysadmin users 4096 Feb 3 13:45 stest/ $getfacl stest # file: stest # owner: sysadmin # group: sysadmin user::rwx group::rwx other::r-x # now run setfacl -R -m u:david:rwX /opt/stest setfacl -dR -m u:david:rwX /opt/stest # gives user:david:rwx default:user:david:rwx #now create a file as other user $ su david -c "touch /opt/stest/test" -rw-rw-r--+ 1 david users 0 Feb 3 13:51 test #set with owner only rw like how chromium does -rw-------+ 1 david users 0 Feb 3 13:51 test $ getfacl test # file: test # owner: david # group: users user::rw- user:david:rwx #effective:--- group::rwx #effective:--- mask::--- other::---
So this is the part I'm not getting. Why is the "non-acl" owner of the file
# file: test # owner: david
sysadmin owns the directory. Bascially I thought that setfacl would always give access to the directory owner. It seems as though even if the acl entry was made by
sysdamin must be manually added to any file created by another allowed user or it can get locked out of its own files. That was not intuitive for me.
Is that what i need to do? Do I need to run inotify wait on the directory and then add sysamdin to the acl list if another user creates a file. What is the best solution to my situation ACL or otherwise.
I am running ubuntu 20.04 with kernel 5.4.0-65-
--two days later
I tried another tack. I added both users to the file and default acl list using sudo. Then I logged out and into the other user. Then did a getfacl on one of the offending files. You see both users listed but under effective there is nothing instead of rw. Arrgh. Still the current user
sysadmin can't access the file created by
david. Why is effective not showing rw???
-rw-------+ 1 david david 125146 Feb 6 09:12 Preferences
getfacl Preferences # file: Preferences # owner: david # group: david user::rw- user:sysadmin:rwx #effective:--- user:david:rwx #effective:--- group::rwx #effective:--- group:users:rwx #effective:--- mask::--- other::---