33

I have a ext4 partition and I've set the group owner for all subdirectors to mygroup:

# chgrp -R mygroup /mount/abc
# chmod -R g+swrx /mount/abc

My user is part of that group. Inside that partition is a folder who is owned by user 'nobody' and now by the group 'mygroup'. My user is part of 'mygroup'. Here's an ls -l:

myuser@host:/mount/abc/folder$ ls -l
drwxr-sr-x 2 nobody      mygroup      4096 Apr 25 12:08 ./
drwxrwsrwx 6 nobody      mygroup      4096 Apr 24 07:57 ../
-rw-r-xr-- 1 otheruser   mygroup    159539 Apr 23 23:44 test.png*

myuser@host:/mount/abc/folder$ groups myuser
myuser : mygroup {... a list of other groups also...} 

myuser@host:/mount/abc/folder$ rm test.png 
rm: remove write-protected regular file ‘test.png’? y
rm: cannot remove ‘test.png’: Permission denied

myuser@host:/mount/abc/folder$ touch test.txt
touch: cannot touch ‘test.txt’: Permission denied

Note that I cannot delete nor create a file that is owned by a group that my user is a part of.

I guess I don't fully understand how groups work. I thought if you were part of a group then you inherit the permissions of that group. Am I doing something wrong?

Thanks

  • It looks like the permissions triad is owner-group-world. Above you can see drwxr-sr-x for the directory. So the group's permission is r-s. It looks like the chmod -R didn't recursively set the permissions to rwx. When I flip the w bit for the group permission of the folder, it works. – Chaos Apr 25 '14 at 19:22
47

Did you recently add that user to that group, without logging out/in between? Then "groups" will show the group but the user does not have the group permissions yet.

You can show your effective groups using

$ id

As an example, if I add my user ps to the group fax and then type

$ id

it does not show the group fax, but

$ groups ps

shows fax.

Doing su to your own user gives you the new group affiliation:

$ su ps
$ id

The output now also contains fax.

  • 1
    This is really helpful to know. Especially the 'sudo <username>' part. – Chaos Apr 26 '14 at 17:38
  • 2
    log in/out is so obvious that I missed the point, many thanks buddy! – nicolallias Mar 18 '15 at 16:20
  • 1
    @peschü I have sudo and use it regularly. The error I showed you is complaining that the command ubuntu (i.e., the user name) is not a recognised command. I do not think your suggestion is syntactically correct - perhaps it works in your case because ps happens also to be a command as well as a user name. – beldaz May 31 '16 at 5:11
  • 1
    @beldaz oh no! You are right! syntactically correct it is su <username>. I have edited the post. – peschü May 31 '16 at 7:12
  • 1
    damn the old log out/log in again work every time. – Steampunkery Feb 15 '18 at 19:58
5

The method that you have used seems to be correct. I just now tried to replicate it, and it worked just fine.

I am not sure if there is a typo, but there is a slight problem with the command. There is no need to have "mygroup" mentioned in there. The following works

# chmod -R g+swrx /mount/abc

Even, you can remove the s bit, just do g+rwx. After you have changed the permissions, and you do ls -l, it should display the relevant privileges.

  • 2
    I removed the typo with the groupname. The directory has the wrx permissions on it when you do ls -l, and it is owned by nobody:mygroup. Even though myuser is part of mygroup, myuser still cannot create/delete files. I hope that makes sense. – Chaos Apr 25 '14 at 16:38
1

To add to the accepted answer (since I can't comment yet):

If you use software like BitVise to create a SSH connection to your server, simply closing & re-opening a terminal will not count as logging in & out. It will do things like reload your ~/.bashrc, but not perform the actual group updates (if you added the group in your "login" session). For this to take effect you would have to fully logout and login again with your SSH-key/credentials.

1

Directories need x bit set (for directory that bit is seen as search bit) to open. So I use tree so I can get only the folder set and avoid the nightmare of having all the files set as executables ( the option for tree is -d List directories only.):

sudo tree -faid /mount/abc | xargs -L1 -I{} sudo chmod 755  "{}"

Warning!!! you should have this into considerations:

  • using chmod or chown recursive on root / directory or system directories will destroy your OS (actually anything recursive on / directory or system directories is dangerous)

  • this is not a good security practice to set permission bulk like that

  • 1
    Great thanks! The words "Directories need x bit set" solved my problem! I did "sudo chmod g+x <parent dir path>" and it worked. – kinORnirvana Apr 19 at 11:31
0

You cannot remove the file because the group mygroup doesn't have write permissions on the file test.png as well as the folder. For write operations to work on the file the file permissions should look like:

-rw-rwxr-- 1 otheruser   mygroup    159539 Apr 23 23:44 test.png*

If you take a closer look at the permission format

duuugggooo

The first three placeholders uuu are user read, write and execute. The next three placeholders ggg are for the group and ooo for others. In the snippet posted by OP group is missing the write permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.