2

I'm not a linux expert and I would like to know how can I fix this situation:

there is an user called demo which have as id 1000, this user is associated to www-data group, so the demo user can actually remove / edit / create all the files of a project, eg:

enter image description here

now suppose that I'm logged in with the user foo which has the id 1001. If I try to edit a file, eg: .env I will get permission denied.

Is there a way to give the same permissions of the group owner (1000) to the user foo?

So I can simply add the user foo to the group of the demo user, and then foo can actually remove / edit / create as if the user were demo.

How can I achieve this?

Thanks in advance.

3
  • Unless you used some particular formatting, the result of the ls you display contradicts your comments : As it seems, owner is www-data, group 1000.
    – MC68020
    Oct 27, 2022 at 11:05
  • @MC68020 you right, I have confused this in the question. so how can I give the same permission to the file owned by www-data to all the the users of group 1000?
    – sfarzoso
    Oct 27, 2022 at 11:09
  • The owner is unique. You can grant all permissions you want (rwx) to group members, you'll never grant them the unique (shared with root) privilege of the owner : to delete the file. You can think of allowing your users to sudo www-data for that purpose.
    – MC68020
    Oct 27, 2022 at 11:13

4 Answers 4

1

The owner of a file is… unique.

You can grant read, write and execute permissions to anyone else, anyone member of some group but…

you won't deprive the owner from it's unique (shared with root) privilege to remove the file.

If you want other users to also be capable of removing some file they do not own then… the only possibility is to enable them to usurp the owner's id using su.

Therefore, if you need other users to be able to remove files owned by the www-data, you'll have to authorize them using su www-data

1

Try: usermod -a -G 1000 foo.

But the user 1000 is not associated to www-data group, the www-data user is associated with group 1000, You should definitely take a look at that.

2
  • you right, I have confused this in the question. so how can I give the same permission to the file owned by www-data to all the the users of group 1000?
    – sfarzoso
    Oct 27, 2022 at 11:09
  • In your example you have e.g. the permissions rwxr-xr-x which reflect the permissions for the user, the group and the world (read write execute). The group does have r-x which meand everybody in the group can read and execute the file (x for directories means it can be traversed into).
    – stoney
    Oct 27, 2022 at 11:21
1

If you want two users that have read-write access, and the rest with read-only access, just create a group for those two users, and give the group rwx permissions. Also let the group have rwx access to the directory, so both users can create and delete files, and set the setgid bit on the directory so that the group of new files is taken from the directory (and not the creating user).

This works as long as both/all involved users have a correctly set umask, i.e. 002 in this case. If they don't, one will inevitably create a file where the group has no write permission, thus locking the other user out. You can't delegate the file owner's privilege of changing the file permissions.

(Well, if the other user knows the trick, they can create the file with a new name, and rename it on top of the original, now being the owner of the new file.)


If you need to have two users with read-write access, a group with read-only access, and no access to others, then you should probably look into ACLs instead. Default ACLs would also help with the umask issue.

0

Using ACLs, you could grant your goals.
Here is a good start.

I wouldn't go any further because the subject of your question is a bit mixed up. May be you could edit to clarify ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.