How to allow access to only one NTFS folder of already mounted partition for specific user?

Question

I have two users: userA and userB. I have also NTFS formatted parition. Whole parition is only accessible to userA thanks to this in /etc/fstab:

/dev/sda3 /home/userA/data ntfs-3g defaults,rw,nouser,uid=userA,umask=077,exec 0 0

. I want to allow ONE folder (for example /home/userA/data/movies) to be accessible for userB, but not whole drive. How can I do this?

If I allow all users in fstab, both users have access to whole drive, regardless if it is mounted in /home/userA/ folder. userB can simply do

ls /home/userA/data

even if he can't do

ls /home/userA

If I leave fstab as I have it set now and I use symlink, symlink respects permissions to folder it's linked to and userB won't be allowed to use this symlink.

I also tried to use remount option, but only thing it can change is ro/rw option, it can't change uid, guid or similar for ntfs partitions. I guess policy below (from man mount) applies to ntfs too:

The -o remount may not be able to change mount parameters (all ext2fs-specific parameters, except sb, are changeable with a remount, for example, but you can't change gid or umask for the fatfs).

Answer 1

I assume the client machine is running Linux.

Linux has the ability to create multiple views of all or part of the same filesystem. You can use this to make only part of a filesystem accessible to a user (subject to further permission checks).

/dev/sda3 /home/userA/data ntfs-3g defaults,rw,nouser,uid=userA,umask=077,exec
/home/userA/data/subdir /home/userB/subdir bind

The command mount --bind /home/userA/data/subdir /home/userB/subdir sets up that second view.

If /home/userA is not accessible to user B then user B will not be able to access the NTFS partition through that view. However user B will be able to access the subdir directory through the view at /home/userB/subdir. Permissions still apply: some files under subdir may not accessible if their permissions exclude userB.

If you want to tweak permissions as well (to allow userB to access all files, or to grant read-only access only, etc.), you can use bindfs. See read only access to all files in a specific sub-folder and Allow a user to read some other users' home directories for example.

Answer 2

NTFS-3g supports access control lists, ACLs. It's highlighted here on the NTFS-3g website. To interact with ACLs you use the command line tools setfacl & getfacl.

If this works with your particular mounted shares you should be able to use the setfacl command to allow userB access to this one particular folder.

$ setfacl -m user:userB:rwx /home/userA/data/movies

You may need to allow more than the above given it's a directory, the command above I've used for giving out just single file access.