0

This question already has an answer here:

Let's say I have 3 users on my server:

  • /home/bob
  • /home/joe
  • /home/fred

I want to create a folder at /share in which bob and joe can both add and delete files. I want all of files added to that directory to have permissions such that both users can modify or delete them.

The issue is that when directories are created within /share/, they are created with permissions for the owner. If a folder is created in /shared then it belongs to the creator, and nobody else can modify/delete its contents.

I need to have this folder behave such that everything created in it has full rwx permissions for everyone.

marked as duplicate by muru, s3lph, Eric Carvalho, Fabby, Elder Geek Jan 29 '15 at 16:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

Using Groups

Like Trevor said, you can make a group, and give that group read, write, and execute, permission to that folder.

To create a group:

sudo groupadd groupname

You can use anything in the place of groupname, just remember what it is! Next, let's create a folder in /share

sudo mkdir /share

Set that folder's group to the created one, and well as set permissions

sudo chgrp groupname /share
sudo chmod 775 /share

Remeber to change groupname to the one your created! You can see that we change the permissions of /share to 775, here's a explaination of what that means.

7 in the first position, this gives the owner of the folder, read (lists files in folder), write (create/delete files in folder), and execute (be able to cd into that folder). In our case the owner of the folder is root.

7 in the second position, this gives the folder's group, read, write, and execute permission. In our case the folder's group is groupname or whatever you set it to.

5 in the final position, this gives the the public (whoever can logon to the system), read, and execute permission. This allows them to cd into folder and list the files using ls or a similar command. If you want to prevent others from cd'ing into the folder you can use 0 instead of 5, meaning they get no permissions.

To add a user to a group, so that can use the group permissions, we can use:

sudo usermod -a -G groupname [username]

Be sure to change groupname and [username] to their correct values.

Note: a user may only be in one primary group, but multiple secondary groups. The command I provided adds another secondary group to the user specified.

Using ACLs

A alternate solutions, which I think is more complex is to use ACLs (or Access Control Lists). This allows you to grant specific permissions to specific users without the use of groups or changing owners. For this to work the file system must be mounted with the acl option.

Preparing to use ACL

Firstly, we must check if the drive is already mounted as ACL. Because we the folder is in the /share is in the root (/) partition, we must ensure that the root partition is already mounted with the acl option.

Note: The /home is not always inside the root partition, the /home folder can be it's own partition. This also applies to other partitions.

To determine if a partition has ACL enabled, we can use the mount command.

mount -l

For me, this is on the first line.

/dev/sda5 on / type ext4 (rw,errors=remount-ro)

We can see that the partition /dev/sda5 is mounted at /. Yours may not be on the first line, like mine. It may be on the second, third, but it should be mounted at /, because that's where our /share is.

Now, we will need to determine if we have the acl option.

tune2fs -l [partition path]

From my output of mount -l you can see that my partition path is /dev/sda5, yours may be different.

From running the command we will get something similar to this:

tune2fs 1.42.9 (4-Feb-2014)
Filesystem volume name:   <none>
Last mounted on:          /
Filesystem UUID:          5e7b3dcf-cda0-4a74-ab0e-67c9ce8ab044
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery extent flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize
Filesystem flags:         signed_directory_hash 
Default mount options:    user_xattr acl
Filesystem state:         clean
~cut off to save space~

On the default mount options line, we can see that we have acl enabled. If you don't have acl enabled, you can use Google find out how to do that.

Now, like the method with groups, you will need to create the folder:

sudo mkdir /share

One last thing, we must set the folder to 700, so only root (and people granted access by ACL) can access the folder:

sudo chmod 700 /share

Now we can set the access control. Note: setting the permissions, without using acl, and instead using chmod, will cause acl permissions to be reset.

Setting ACL permissions

It's a bit simpler now, if you want to set permission for a user, you can use

sudo setfacl -m "u:[username]:rwx" /share

This will grant [username] rwx (read, write, execute) permissions. The sudo is required only because /share is owned by root.

For a group use:

sudo setfacl -m "g:[groupname]:rwx" /share

For a other/public (only includes people who are able to logon to the system) use:

sudo setfacl -m "o:rwx" /share

Note: you can swap rwx out for others like rx for read/execute only. Note: if you pass a -d option while using setfacl (setfacl -d -m "u:...), this will set the default ACL value for the folder. This will cause any NEW files added to the folder to automatically have the permissions you applied.

  • I edited the question to highlight the issue better. The problem is the permissions that new files are created with – kbuilds Jan 29 '15 at 0:42
  • @jkurtisr32 I've edited my answer to include how to use ACL, to solve your problem (The last Note: at the bottom will explain how to fix your problem). – Henry Jan 29 '15 at 1:15
0

EDITED:

Make a user group, right click the folder you want and set appropriate permissions for that group! Hope this helps!

  • The issue is that if a folder is created in /shared then it belongs to the creator, and nobody else can modify/delete its contents. I am trying to build a sandbox where the permissions of everything is 777 for people of a specific group – kbuilds Jan 28 '15 at 23:24
  • a means everyone – Trevor Clarke Jan 28 '15 at 23:25
  • But the permissions of the folder don't apply to created files within that folder. So if one user created a folder /share/thing1/, another user could not create /share/thing1/file.txt. They would get "permission denied" – kbuilds Jan 28 '15 at 23:27
  • Looks like mount might be a good way to go about this – kbuilds Jan 28 '15 at 23:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.