1

I need to install acl in order to set up a very specific permission structure. Group members should be able to see the files in a directory and change into the subdirectories. However, they should not have permission to read the files!

I don't know how to achieve this. The command setfacl -m d:g:mygroup:rx will do part of the job, but then all files become readable. So, I need to apply this rule only to the folders (drwxrwx---), everything else should be inaccessible (rw-------).

  • You need to use umask See for more cyberciti.biz/tips/… – Valentin Bajrami Aug 26 '13 at 9:37
  • 1
    I do not believe that umask will work, even if set “correct” for all users. Also not sure that default acl can do it (as this is an unusual need). Consider a cron job to do it, with acl set up to limit permissions, and the cron job to increase them( with a delay ), then consider adding the script to a file update hook. – ctrl-alt-delor Aug 26 '13 at 12:41
2

You can set the default ACL to give this group execute-if-executable (X) but not read permission.

setfacl -R -d -m group:mygroup:X .

This way, newly-created files will not be group-readable, but the group will be able to traverse the directories. However the group will not be able to list directory contents. I think that's the closest you can do with Solaris/Linux ACLs.

Since this ACL is more restrictive than what you want, it is safe to apply this ACL and later add read permission to directories. You can do it automatically through inotify, for example with the following incrontab:

/path/to/directory IN_CREATE /path/to/script $@

where the script contains

#!/bin/sh
if [ -d "$1" ]; then setfacl -m group:mygroup:r -- "$1"; fi

Another approach is to create a view of that directory tree with different permissions, with bindfs. Bindfs supports different permissions for directories and regular files.

bindfs -g mygroup -p gd=rx,gf= /path/to/original/root /path/to/mount/point
0

If you want this permissions to be enforced for all the files/directories you create in the future, use umask as suggested in the first comment to your question.

If this is an one-time activity -- you already have the directories and files in place and want to fix the permissions -- you can use the find command at the top level directory:

# Give all permissions to all for the directories and    
# Revoke the permission for others    
find . -type d -exec chmod +rwx,o-rwx {} +    
# Unset all premissionas for all files and    
# Give read & write premission to the owners    
find . -type f -exec chmod -rwx,u+rw {} +    

One could think of scheduling these commands with cron, but I guess that would not be a great idea. For example, non-owners could read files in the time window until the next schedule of the cron job.

  • So how would we use umask? (it has fields for user/ group/ other, but not for directory/file). – ctrl-alt-delor Aug 26 '13 at 12:43
  • @richard I agree with your comment -- seems umask won't be useful. – Barun Aug 26 '13 at 13:45
  • Unfortunately this is no one-time activity, but thanks for your answer. – Hurrdurrfurr Aug 26 '13 at 19:20
0

You could tackle the solution from a slightly different angle and use something such Incron or Inoticoming (the latter is a Debian tool that has been ported to many distributions). With both of these you can watch the directories and action file permission changes on certain key events. According to incron this requires a kernel of 2.6.13 or later with inotify compiled in. It appears on ubuntu, debian and Fedora as packages, so it is easily installed (and looks like it is ported to a number of distros).

There is a nice article on using inotify's incron on nixCraft

  • I have concerns about permission security with this solution, but on the other hand, it's not critical. If I don't find a solution with ACL, I will give this one a go (and mark it as the answer). – Hurrdurrfurr Aug 26 '13 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.