How to allow users of a group to have the same permission of the owner?

Question

I'm not a linux expert and I would like to know how can I fix this situation:

there is an user called demo which have as id 1000, this user is associated to www-data group, so the demo user can actually remove / edit / create all the files of a project, eg:

now suppose that I'm logged in with the user foo which has the id 1001. If I try to edit a file, eg: .env I will get permission denied.

Is there a way to give the same permissions of the group owner (1000) to the user foo?

So I can simply add the user foo to the group of the demo user, and then foo can actually remove / edit / create as if the user were demo.

How can I achieve this?

Thanks in advance.

Answer 1

The owner of a file is… unique.

You can grant read, write and execute permissions to anyone else, anyone member of some group but…

you won't deprive the owner from it's unique (shared with root) privilege to remove the file.

If you want other users to also be capable of removing some file they do not own then… the only possibility is to enable them to usurp the owner's id using su.

Therefore, if you need other users to be able to remove files owned by the www-data, you'll have to authorize them using su www-data

Answer 2

Try: usermod -a -G 1000 foo.

But the user 1000 is not associated to www-data group, the www-data user is associated with group 1000, You should definitely take a look at that.

Answer 3

If you want two users that have read-write access, and the rest with read-only access, just create a group for those two users, and give the group rwx permissions. Also let the group have rwx access to the directory, so both users can create and delete files, and set the setgid bit on the directory so that the group of new files is taken from the directory (and not the creating user).

This works as long as both/all involved users have a correctly set umask, i.e. 002 in this case. If they don't, one will inevitably create a file where the group has no write permission, thus locking the other user out. You can't delegate the file owner's privilege of changing the file permissions.

(Well, if the other user knows the trick, they can create the file with a new name, and rename it on top of the original, now being the owner of the new file.)

---

If you need to have two users with read-write access, a group with read-only access, and no access to others, then you should probably look into ACLs instead. Default ACLs would also help with the umask issue.

Answer 4

Using ACLs, you could grant your goals.
Here is a good start.

I wouldn't go any further because the subject of your question is a bit mixed up. May be you could edit to clarify ?