1

I'm new to RHEL, and I'm having issues unmasking a collections of directories.

I have a folder where content will be generated content from a python script. The subfolders will exists for a period of time, then get deleted. The folders were originally masked with one user being able to read/write to them, but recently we needed to allow anyone to access these folders. I ran the unmask command on the folder with the -R (recursive option) to unmask all subfolders and files. It appeared to work until new content was generated and BAM same problem, the folders and files were masked.

How do I permanently unmask all sub-folders and files for a folder? I need these files to be accessible to everyone with create/read/write access.

1

The process that's creating the files is the issue. This process/program is running with a given umask such that when it creates files the newly created files will be created with a particular umask. You essentially have 3 options:

  1. Modify processes' umask

    Depending on what the process is (web server) this is probably not what you want to do.

  2. Add a group

    The more friendly way to do this would be to create a Unix group (web-data), again if it's web server related content that everyone needs access to. Then change the top level group of the directories in question, so that they're owned/accessible by members of group web-data.

    Then run commands similar to these to make the directory's group web-data, and to force the group to be sticky, so that any new files/folders created will be made with this group as their default.

    $ chgrp web-data /path/to/dir
    $ find /path/to/dir -type d -exec chmod g+xs {} +
    

    Finally add the web server user (apache) to this group along with others that need access to this directory.

  3. use access control lists (ACLs)

    You can use the tools setfacl and getfacl to manipulate ACLs on a given directory or file.

    Example

    As root:

    $ mkdir somedir
    $ getfacl somedir
    # file: somedir
    # owner: root
    # group: root
    user::rwx
    group::r-x
    other::r-x
    

    Now add access for user sam to the directory.

    $ setfacl -Rm u:sam:r-x,d:sam:r-x somedir
    getfacl somedir/
    # file: somedir
    # owner: root
    # group: root
    user::rwx
    user:sam:r-x
    group::r-x
    mask::r-x
    other::r-x
    default:user::rwx
    default:user:sam:r-x
    default:group::r-x
    default:mask::r-x
    default:other::r-x
    

    Now any subsequent directories and/or files that get created will have their directories set so that user sam can access them:

    $ mkdir anotherdir
    $ echo "hello world" > anotherfile
    

    Confirm the permissions:

    $ getfacl another*
    # file: anotherdir
    # owner: root
    # group: root
    user::rwx
    user:sam:r-x
    group::r-x
    mask::r-x
    other::r-x
    default:user::rwx
    default:user:sam:r-x
    default:group::r-x
    default:mask::r-x
    default:other::r-x
    
    # file: anotherfile
    # owner: root
    # group: root
    user::rw-
    user:sam:r-x            #effective:r--
    group::r-x          #effective:r--
    mask::r--
    other::r--
    

    Now as user sam:

    $ more anotherfile 
    hello world
    

    If another user needs similar access, simply rerun the setfacl command using that user's username in place of sam.

    The above approach could be modified so that instead of a single user being granted access, a group of users could be granted access instead.

References

  • Thank you, Can you make option 3, so any user can rwx on the folder? – code base 5000 Aug 28 '13 at 13:37
  • @josh1234 - yes just change the r-x in the setfacl so that they're rwx. – slm Aug 28 '13 at 13:39
  • I did setfacl -Rm d:o:rwx <folder>, but I get operation not supported. Any idea what I'm missing? – code base 5000 Aug 28 '13 at 14:28
  • @josh1234 - as root or using sudo? You need permissions to do this activity on the directory. What RHEL is this? – slm Aug 28 '13 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.