5

I have two groups "Group1" and "Group2"

I have also folder "Folder"

I want to give Group1 read and write permission , while Group2 only read .

Any suggestion ?

2
  • Is there a Group 3 - no access whatsoever?
    – Wilf
    Feb 16, 2014 at 0:45
  • 1
    no just 2 groups
    – nux
    Feb 16, 2014 at 0:46

2 Answers 2

13

Let me get this straight:

  1. You want group1 to have read/write access to a particular folder.

  2. You want group2 to have read-only access to that folder.

  3. You don't want others to have read access to that folder.

By default, Linux's permission system does not allow for this. The reason is simple: for each inode there are only three bits (rwx) that describe permissions for a particular group, namely the group that owns the file/directory referred to by that inode. Any user who is not the owner nor belongs to that group automatically falls under others. In practice this is most often sufficient, but in some rare cases it may not be.

The good news is that Linux actually supports ACLs (access control lists), which allow for a much more fine-grained access control. In order to enable ACLs, you have to add acl to the mount options. For instance, if the partition that contains the directory where you want to set up advanced access control is mounted like this in /etc/fstab:

/dev/sda1  /      ext4    defaults                    0 1

...you would change that to:

/dev/sda1  /      ext4    acl,defaults                0 1

Then you need to remount the filesystem (e.g., mount -o remount /dev/sda1), or simply reboot.

Next let's make sure your folder /path/to/folder grants read/write access for group1. The permissions should look something like

drwxrwx---   2 owner group1      4096 Dec 14 02:42 folder

Additionally, you want to grant read access for group2, and no access at all for others. To achieve this, issue the command

setfacl -m g:group2:rx /path/to/folder

That's it. You can look into the ACL permissions of that folder later by using getfacl, namely:

getfacl /path/to/folder

More information here: ACLs: Extended file-permissions.

2

These commands should work:

sudo chown -R OWNER-USERNAME:GROUPNAME /PATH/TO/Folder
sudo chmod -R 664 /PATH/TO/Folder

This will hopefully provide read & write access to the owner and the group, and read-only access to 'Others' which should include Group2.

chmod manual page here.
chown manual page here.

To reset any changes so only the owner has access, run:

sudo chown -R OWNER-USERNAME:OWNER-USERNAME /PATH/TO/Folder
sudo chmod -R 600 /PATH/TO/Folder
4
  • 2
    man i don't others to have read permission
    – nux
    Feb 16, 2014 at 0:52
  • 1
    That is sort of what I meant by my above query - should of been clearer... So you don't want others to access this? They will still need to logged as users, not just ANYONE can access it.
    – Wilf
    Feb 16, 2014 at 0:53
  • 1
    the owner is not in any group
    – nux
    Feb 16, 2014 at 0:55
  • The owner is usually in the group which is their username - I think it should be fine if the files are not in that group. If not, you can rectify it with sudo chown -R OWNER-USERNAME:OWNER-USERNAME /PATH/TO/Folder; sudo chmod -R 600 /PATH/TO/Folder
    – Wilf
    Feb 16, 2014 at 0:57

Not the answer you're looking for? Browse other questions tagged .