Directory Permissions Defaults
Problem: Sharing Directories
My wife and I keep our pictures of our kids under a shared directory called /home/shared. We download them with Digikam and sometimes edit them to send out to relatives. The problem was this: if I download the pictures off the camera, then Megan can't edit them or read them. We also had problems with shared files (e.g., our accounting spreadsheets) that I would create and she would modify, or vice versa.
Edit the fourth field of the fstab entry of the partition you want to use ACL on. In this case, it was /dev/sda6 on /home:
/dev/sda6 /home ext3 defaults,acl 1 1
adding "acl" to the list of permissions. Without doing this, you'll get
setfacl: /mnt/backup Operation not supported
Then remount the partition: since I was doing this on /home, I rebooted (mount -a did not work).
getfacl(1) shows you the current ACL status of a file:
/media/multimedia: Zshell> getfacl /home getfacl: Removing leading '/' from absolute path names # file: home # owner: root # group: root user::rwx group::r-x other::r-x
Once the partitions are properly set up (that was the easy part), enter the setfacl(1) commands:
sudo setfacl --recursive -dm g:users:rwx /home/shared
--recursive was important so that each directory beneath /home/shared inherits the default mask.
Now getfacl(1) gives me this:
/media/multimedia: Zshell> getfacl /home/shared getfacl: Removing leading '/' from absolute path names # file: home/shared # owner: joel # group: users user::rwx group::rwx other::r-x default:user::rwx default:group::rwx default:group:users:rwx default:mask::rwx default:other::r-x
And when creating a file:
/media/multimedia: Zshell> cd /home/shared /home/shared: Zshell> touch my_self /home/shared: Zshell> ls -l my_self -rw-rw-r--+ 1 joel users 0 2008-04-06 14:36 my_self
The desired outcome!
Note: this did what I wanted, but it's just a beginning. Read the setfacl(1) and getfacl(1) man pages for the full story.
Official ACL Package Data
PACKAGE NAME: acl-2.2.39_1-i486-2 COMPRESSED PACKAGE SIZE: 139 K UNCOMPRESSED PACKAGE SIZE: 350 K PACKAGE LOCATION: ./acl-2.2.39_1-i486-2.tgz PACKAGE DESCRIPTION: acl: acl (tools for using POSIX Access Control Lists) acl: acl: This package contains a set of tools and libraries for manipulating acl: POSIX Access Control Lists. POSIX Access Control Lists (defined in acl: POSIX 1003.1e draft standard 17) are used to define more fine-grained acl: discretionary access rights for files and directories. acl: acl: acl: acl: acl:
Solution 2: SetGuid Flag
Some users are not willing (or able) to apply ACLs on filesystems. There is a way to achieve a similar shared directory effect using native Linux access controls. For example, imagine a SAMBA server with a share called Photos. You need a sub-set of users on the network to be able to manage the files on the share. Additionally, you need new directories created within the share to inherit permissions from the parent.
To accomplish this goal you create a group called mgrphotos and you add the users that should manage the share into that group.
# Set ownership on shared folder chown -R root:mgrphotos /media/share/disk1/Photos # Set permissions on shared folder chmod -R 775 /media/share/disk1/Photos # Applying the setguid bit can allow for new files to "inherit" group membership from its parent (use this sparingly) sudo chmod g+s /media/share/disk1/Photos # Verify the setguid bit ls -all /media/share/disk1/Photos/ | grep -i family drwxrwsr-x 24 root mgrphotos 4096 2012-03-01 15:02 Family
All new files created in the path are now owned by the mgrphotos group. Since this volume is mounted as 775, all members of mgrphotos share the files/folders they create on this volume.
It's highly recommended that you leverage ACLs wherever possible but this is an alternate solution that works extremely well and required no extra packages or configuration.