0

Using a Rocky Linux server, I created a user using the following command,

sudo adduser foobar

and user foobar is now a member of group foobar. We can confirm with the following.

foobar$ id
uid=1111(foobar) gid=1111(foobar) groups=1111(foobar)

Notice that the uid and the gid are the same.

Now, for files and directories owned by foobar, are the owner permissions the same as group permissions?

Example

For the following directory,

drwxrwx---  1  foobar  foobar  my_dir

curiously, user baz who does NOT belong to group foobar has write access under my_dir.

baz$ id
uid=2222(baz) gid=10000(group1),10001(group2)
baz$ touch my_dir/test  # (?)
baz$ ls my_dir
test

The (?) line above: how is baz able to write into my_dir when the 'others' bits are turned off?

1
  • Can you try to ls my_dir/test from user baz? Can you try to write some content to the file as well? Also paste your /etc/group here eventually. Dec 6, 2023 at 19:24

2 Answers 2

1

Linux supports the basic file modes (rwxrwxrwx) but also supports ACL lists. I suspect you have set some ACL list that permits baz to write.

getfacl my_dir 

may show the situation.

1
  • This was indeed the case. The permission bits are actually drwxrwx---+. The plus sign indicates additional items in the access control list. Thanks! Dec 7, 2023 at 5:26
0

User and group permissions in unix are separate, even if coincidentally named the same and/or having the same numeric ID.

The adduser command is not 100% standardized, and some versions create a group with the user and some don't and even the ones that do can be told not to, and ones that don't typically can be given a group name to create with the user. Some versions of adduser if not given a group name, will assign the user to the 'users' group or some similar default group.

Also, the groupid and userid are only coincidentally the same (likely assigned to the next sequential one available), and these can easily become out of sync. (I find this annoying and sometimes bother to fix it afterwards.)

The other answer gives a plausible explanation why the touch worked. Another possibility is that the 'test' file already existed before the touch and maybe baz has write access to the file but not the directory, or it didn't print an error in updating the time for some reason since the file already existed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .