Group permissions allow, but still get permission denied

Question

I have a ext4 partition and I've set the group owner for all subdirectors to mygroup:

# chgrp -R mygroup /mount/abc
# chmod -R g+swrx /mount/abc

My user is part of that group. Inside that partition is a folder who is owned by user 'nobody' and now by the group 'mygroup'. My user is part of 'mygroup'. Here's an ls -l:

myuser@host:/mount/abc/folder$ ls -l
drwxr-sr-x 2 nobody      mygroup      4096 Apr 25 12:08 ./
drwxrwsrwx 6 nobody      mygroup      4096 Apr 24 07:57 ../
-rw-r-xr-- 1 otheruser   mygroup    159539 Apr 23 23:44 test.png*

myuser@host:/mount/abc/folder$ groups myuser
myuser : mygroup {... a list of other groups also...} 

myuser@host:/mount/abc/folder$ rm test.png 
rm: remove write-protected regular file ‘test.png’? y
rm: cannot remove ‘test.png’: Permission denied

myuser@host:/mount/abc/folder$ touch test.txt
touch: cannot touch ‘test.txt’: Permission denied

Note that I cannot delete nor create a file that is owned by a group that my user is a part of.

I guess I don't fully understand how groups work. I thought if you were part of a group then you inherit the permissions of that group. Am I doing something wrong?

Thanks

Answer 1

Did you recently add that user to that group, without logging out/in between? Then "groups" will show the group but the user does not have the group permissions yet.

You can show your effective groups using

$ id

As an example, if I add my user ps to the group fax and then type

$ id

it does not show the group fax, but

$ groups ps

shows fax.

Doing su to your own user gives you the new group affiliation:

$ su ps
$ id

The output now also contains fax.

Answer 2

The method that you have used seems to be correct. I just now tried to replicate it, and it worked just fine.

I am not sure if there is a typo, but there is a slight problem with the command. There is no need to have "mygroup" mentioned in there. The following works

# chmod -R g+swrx /mount/abc

Even, you can remove the s bit, just do g+rwx. After you have changed the permissions, and you do ls -l, it should display the relevant privileges.

Answer 3

Directories need x bit set (for directory that bit is seen as search bit) to open. So I use tree so I can get only the folder set and avoid the nightmare of having all the files set as executables ( the option for tree is -d List directories only.):

sudo tree -faid /mount/abc | xargs -L1 -I{} sudo chmod 755  "{}"

Warning!!! you should have this into considerations:

• using chmod or chown recursive on root / directory or system directories will destroy your OS (actually anything recursive on / directory or system directories is dangerous)

• this is not a good security practice to set permission bulk like that

Answer 4

You cannot remove the file because the group mygroup doesn't have write permissions on the file test.png as well as the folder. For write operations to work on the file the file permissions should look like:

-rw-rwxr-- 1 otheruser   mygroup    159539 Apr 23 23:44 test.png*

If you take a closer look at the permission format

duuugggooo

The first three placeholders uuu are user read, write and execute. The next three placeholders ggg are for the group and ooo for others. In the snippet posted by OP group is missing the write permission.

Answer 5

To add to the accepted answer (since I can't comment yet):

If you use software like BitVise to create a SSH connection to your server, simply closing & re-opening a terminal will not count as logging in & out. It will do things like reload your ~/.bashrc, but not perform the actual group updates (if you added the group in your "login" session). For this to take effect you would have to fully logout and login again with your SSH-key/credentials.