0

I am Windows 7 remoting to Ubuntu 12.04.2 LTS

I am new to Ubuntu ( and *nix in general ) and need to understand how permissions are assigned to newly created dirs.

Via Putty ssh session :

$bash
myaccount@mybox:/$ cd /etc/puppet
myaccount@mybox:/etc/puppet$ sudo mkdir device
myaccount@mybox:/etc/puppet/device$ 
myaccount@mybox:/etc/puppet/device$ ls -ld
drwxr-xr-x 2 root root 4096 Jul 2 17:57

Then via WinSCP session ( SCP mode , also logged-in as myaccount@mybox ) I attempt to copy a file to /etc/puppet/device

However this operation fails with an error displayed in pop-up:

Error
Copying file 'myfile' failed.
scp: /etc/puppet/device/myfile: Permission denied

It seems logical to me that if my account is assigned sufficient rights to create a dir then it should also have rights to copy a file into that dir ?

Or do creating dirs and moving files fall under separate roles ?

NOTE: If you are going to down-tick my post, please explain why in a comment. Just anonymously down-ticking doesn't help me understand how these forums work. Seems like I'm playing by the rules, full details, following-up on comments, etc.

migrated from serverfault.com Jul 5 '13 at 11:31

This question came from our site for system and network administrators.

  • 1
    What are the rights on that folder? (Do a ls /etc/puppet/device/). – Hennes Jul 4 '13 at 4:51
  • Can you please give the exact command line commands you have used? This will help us to solve your problem. – Uwe Plonus Jul 4 '13 at 6:13
  • Please share exact and complete error message you get in WinSCP. – Martin Prikryl Jul 4 '13 at 6:14
  • 1
    I have added info on exact commands , exact error messages , and permissions on the new dir. Not sure why people are down-ticking my question ? It seems like I've run into a barrier a lot of *nix newbies face. – BaltoStar Jul 4 '13 at 11:34
  • Ok fair enough, but the About page says ServerFault is for professional systems administration questions - wouldn't that include Windows sysadmins learning *nix ? I am in a complex enterprise environment and it seems my question satisfies all the criteria spelled-out on the About page. – BaltoStar Jul 4 '13 at 17:21
2

In hope that I didn't overlook something:

  • You used sudo to create a directory
  • Your ls clearly states that the directory is owned by root
  • When trying to copy files into that folder as user "myaccount" you are denied

This is normal behaviour. You have the following options:

  • Grant write access to "others" (chmod o+w /etc/puppet/device => very bad idea)
  • Create a group e.g. named "adm-puppet" and add all the users allowed to create files in that dir and the puppet user. Then change the group ownership to that group
  • Add users allowed to write files in that directory to the exisisting puppet group
  • Use extended ACLs
  • Thanks for the answer weeheavy , but here is what I find non-intuitive: I had to use sudo mkdir because myaccount doesn't have sufficient rights to execute file operations -- yet myaccount has the right to run sudo commands ! To my newbie eyes, this seems like a "loophole". In Windows, there is no sudo : a user that belongs to local admins or domain admins group inherits rights but still operates as that user. Also, isn't there some way to run WinSCP as sudo ? – BaltoStar Jul 4 '13 at 17:11
  • Isn't it a bit like UAC? Well I see your point, I don't like Ubuntu's global sudo, too. For specific tasks (restart daemon foo etc.) it's okay. Here's the explanation of Ubuntu: help.ubuntu.com/community/RootSudo – weeheavy Jul 4 '13 at 20:11
0

When you use sudo to create a file or a directory, you are running the command as root, so the file will of course be owned by root.

If you can't create the file/directory (minor hint: directories are just special files) as the normal user, root can "give" it to the normal user with chown (syntax chown user:group file).

If multiple users will need write access to the file, but not all, you will need to use a group; if you don't think a group is necessary you can use the group named after the user which usually exists (root and nobody are poor choices in such a situation, which is why users generally have individual groups also).

If you use a group with multiple users in it, you will also need to change the permissions to grant write access to the directory to the group. Write access to a directory means the ability to create and remove files in it (execute is traverse, and read is list contents). Do this with chmod g+w dirname.

  • Thanks for the resonse Falcon. When use say "the after the user which usually exists" and I understanding that the convention is for admins to create a parallel group for each user ? I can see how this would be convenient for the purpose of assigning one user all the rights another user possesses. Is this the purpose ? – BaltoStar Jul 7 '13 at 23:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.