24

I have a /data folder (actually a partition) for all data that should be accessible by all users (in this case family members). We all have individual user accounts and are often all logged in at any time on this one PC.

How can I set up permissions so that we all retain access to files there no matter who creates them, including new folders? If I create a folder it gets my user and group, so nobody else can write to it.

2
  • for the visitors. If you just want the group name to be inherited chmod -R g+s /parentdir. Note: run chmod -R prior to this if needed Jan 19, 2018 at 0:25
  • 2
    Note on the above: the -R flag to chmod is very rarely useful because we seldom want directories (which always need some execute permission) and regular files (which rarely need any execute permission) to have the same permissions
    – Zanna
    Mar 28, 2018 at 8:18

7 Answers 7

19

Another approach is to use Access Control Lists, a superset of file permissions.

First of all, we have to install the acl Install acl package:

sudo apt-get install acl

Before Ubuntu 14.04, the partition has to be mounted with the option acl for the following to work. It could be added in /etc/fstab, as in

UUID=<XXXX>  /media/shared  ext4  noatime,acl  0  2

or for an already mounted filesystem

sudo mount -o remount,acl /media/shared

Next, you should create a new group, to which all users allowed to access the share in read/write mode will be added. I call it usershare. An already existing group could be used.

sudo addgroup usershare

Now we add the users enzotib and steevc to that group:

sudo gpasswd -a steevc  usershare
sudo gpasswd -a enzotib usershare

(effective at the next login).

Then we add an ACL with rwx permissions for the group usershare to all files already in /media/shared

sudo setfacl -Rm g:usershare:rwX /media/shared

Finally we add a default ACL with rwx permissions for the group usershare for all files created from now on inside /media/shared

sudo setfacl -d -Rm g:usershare:rwX /media/shared

Now all users of the usershare group have full permissions on all files under /media/shared. Permissions of each user on his and other's home directories are not affected.

I tested this solution and seems to work, but suggestions and corrections are welcome.

Remark: new files and directories created in the considered directory will have write permission for the usershare group, but files copied or moved in the folder will retain their original permissions. If the user, as I understand, only require write access to newly created directories, this is not a problem. Otherwise it should modify permissions by hand. See this answer on how to overcome this by defining the umask of users to 002.

3
  • I don't know acl very well, can you test and copy a file with permissions like rw-r--r-- from your home folder to the shared folder and see if the permissions change to your default rwx for the usershare group?
    – arrange
    Jul 11, 2011 at 22:04
  • @arrange: no, it doesn't work as intended. Going to point out in the answer. Thank you
    – enzotib
    Jul 12, 2011 at 1:51
  • I would add that the /etc/fstab / remount step is not required, because ext4 should be mounted with acl option active by default.
    – enzotib
    Aug 15, 2012 at 8:14
9
  1. Make folder.

    For example:

    mkdir /mnt/family
    

    If you need mount partition to them... if ext4 all you need in /etc/fstab is

    UUID=xxx    /mnt/family ext4    **rw,exec,defaults,auto,async   0   2**
    
  2. Create group myfam.

    addgroup myfam
    
  3. Add some users to that group

    adduser papa myfam  
    adduser mom myfam
    
  4. Now take and give permission.

    I think you should start, from changing umask.

    Default filesystem permissions and access rights in 12.04

    chown -R you.myfam /mnt/family  
    chmod -R g+rwx /mnt/family  
    

    Now most important. That line create setgid anything you create under that folder have your users as owner and group myfam. That let system override user primary group.

    chmod -R g+s /mnt/family   
    
3

The simplest thing that come to mind is to add each user to the group of all other users.

Then change umask of each user from 022 to 002, this could be done in /etc/profile.

Edit

The first step could be replaced with the following: make all users belong to users group as the primary group.

Edi2

As @James_Henstridge suggested, it can be convenient to set the setgid bit on the main directory, so that new files and directories created will have its same group, indipendently of the user. In this way you can avoid the set users as the primary group for users.

7
  • You might want to edit your answer to also suggest setting the setgid bit on all the directories in /data so that new files inherit the group ownership. Jul 11, 2011 at 1:04
  • edit3 :) If you copy a file to the /data folder, the permissions are not inherited, so the old files with g-w permissions will not be modifiable by others. edit4: setting users as your primary group and umask 0002 is definitely not a good idea as anyone from that group will be able to modify any of your newly created files.
    – arrange
    Jul 11, 2011 at 10:30
  • @arrange: regarding your edit4, I suggested to put in users group only the users allowed to have rw access to the share. It was a matter of convenience, it could also create another group for that. Regarding your edit3, it is not correct, copied file acquire the folder group.
    – enzotib
    Jul 11, 2011 at 10:38
  • @enzotib: to reiterate my point in other words: edit4 - if users is my primary group and there are more users in this group then they are able to modify my files even outside the shared directory; edit3 - I wrote permissions, NOT folder group.
    – arrange
    Jul 11, 2011 at 11:23
  • @arrange: your point is correct, i just writed another answer, could be interesting to hear your opinion.
    – enzotib
    Jul 11, 2011 at 20:23
2

This sounds like a job for ACLs. Giles has a very thorough answer on the SE Unix and Linux site that helped me solve the very same issue.

1
  • 1
    That worked! I've seen other answers using ACL, but this is the only one I've seen that changes the permissions of not only new files and directories created in the shared directory, but also that of those copied or moved into it. Jul 18, 2012 at 22:38
0

I dont understand, are all linux-linux, linux-windows, linux-???, using Samba?, SSH?, Pigeons?; anyways you need to include the others into the Group with your username (your Group), and they will get the same permissions as you.

1
  • This is multiple users on one PC. I'm sure there must be a way to get the permissions to default to something useful.
    – steevc
    Jul 10, 2011 at 20:34
0

I came across this question while searching for answers for my GROUP PERMISSION problem. I've read the question and It seems I am already implementing what the question tries to accomplish.

So I bothered to answer it.

I have already a setup up of a share for all users on my lan with read and execute only, and only my account has the permission to write on the shared folders.

I have a multi-purpose server on my lan that uses ubuntu 12.04 LTS Desktop Edition. I have a mix client machines of linux and windows.

Heres how I have set it up:

1.On my server, I have user accounts named admin and clientone

The admin account is the account created when I installed ubuntu and the clientone account is the account created using the USER ACCOUNTS menu in ubuntu. It only has a standard permission, no admin priveleges and it is added to the users group. You may of course do these using only the terminal. Add more additional user accounts for your client machines.

2.The shared partition/folder is automounted in fstab using only the defaults option.

3.My network is in a workgroup environment, and It is on mylan workgroup.

All machines in my lan is set to use the mylan workgroup.

4.My shared folder named shared already have files in it. So I change the owner and group for it recursively using the command below.

 sudo chown -Rv admin:users /shared

5.I also set folder and file permission to /shared folder recursively using the command

 sudo chmod -Rv 750 /shared

guest machines in my mylan workgroup does not have access to the share using chmod 750

you may use

 sudo chmod -Rv 755 /shared

All future user accounts within the users group only has read execute permission.

6.In my client machine one (windows xp) I setup a user account named clientone. The same user name and password as with the one created in my ubuntu server. A second account named clienttwo is also created in ubuntu server and it's the same user account used in my second machine (linuxmint 15).

7.In my client machine one upon logging in using the clientone account, I go to run command then enter

 //192.168.10.254/shared

192.168.10.254 is the ip address of my ubuntu server, /shared is the folder shared in my ubuntu server In my client machine two (linuxmint 15), I go to Menu > Network and in the Location: dialog bar I typed in:

 smb://192.168.10.254/shared

If you were prompted for password, enter your user accoun'ts password. And also your keyring password if KEYRING is enable in your linux machines.

This one works for me in my own network setup. My server is a multi purpose server serving as squid server, xbmc and mediatomb server and amahi server.

I am still looking ways on how to improve the file sharing part of my setup. The instruction above is not a bullet proof solution, buy you may try it out. I test and try the ACL” thing together with auto mounting shared folders. As your folder sharing requirement gets complicated, the above instruction will not guaranty you success.

Added Info:

I have Amahi Server installed in my server, I also used it to create user accounts that I wanted to have access to the shared folders. I also used it to create new folder shares.

When you want more complex user permission for different users, ACL is the one to go.

0

I have video files on my name, but when I sign in with my daughters name her account can't see the video files. So, what I did was went to user accounts, unlocked (top right), then changed her account type from "standard" to "administrator(which is what my account is), and now all the video files, really everything, shows up when logged in under her account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .