不同组的Linux目录权限

Question

I'm having two directories: "public" and "private". I have three users: "chris", "john", "dan". I have two groups: "pub", "priv" and "god".

• The group "god" should have full access to "public" and "private".
• The group "pub" should be the only group to have permissions over "public"
• The group "priv" should be the only group to have permissions over "private".

As root:

useradd chris

useradd john

useradd dan

usermod -g god chris

usermod -g pub john

usermod -g priv dan

chgrp god public private

chgrp pub public

chgrp priv private

su chris

As "chris":

cd public/

touch test = permission denied

---

The same for the other users ... under "dan" I have no permissions over the "private" directory, althou "dan" is a member of the "priv" group.

Do you have any idea?

Answer 1

Well, I know this is relatively old, but twalberg is correct: there's actually a relatively easy way to accomplish this with POSIX ACL's. They've existed since the late 90's/early 2000's so I don't know why more people don't use them.

How to do it: Do as you've already done, then simply execute this command:

# setfacl -m g:god:rwx public private

and in one command you get what you're wanting. You'll spend forever trying to figure out how to do it using ONLY traditional unix permissions.

Mikic's advice may still be good (depending on what you're trying to accomplish), and it might be more straight forward to reference as few groups as possible in your permissions (or maybe you want it to be apparent that "chris" isn't a regular user, but an administrative one, again it depends on what you want to construct).

I offered something closer to what you're trying to accomplish, because there may be situations where you're trying to give a secondary user/group access to a directory but you don't want to choose between "chris" not getting access to these two directories and "chris" getting access to all those other files and directories "pub" and "priv" might have access to. With ACL's you don't have to make those choices, which is why they were added and are now a core part of most Unix (and BSD and Linux) platforms.

Answer 2

You said that the group "pub" should be the only group to have permissions over "public". But right before that you said that "god" should also have access. So "pub" can't be the only one that has access. Ditto for "priv".

You also say:

I have two groups: "pub", "priv" and "god".

Well, that's three groups. (Reminds me of that famous quote: "There's three kinds of people in this world; those who can count and those who can't." :-P)

Your base concept seems wrong. The way this works is rather simple. Create two groups, "pub" and "priv". Place all users who need access to the directories accordingly. Users who need access to both directories should belong to both groups.

In this case, "chris" should be put in both the "pub" as well as the "priv" group. "john" should be put in the "pub" group. "dan" should be put in the "priv" group.

What you were trying to do is having the directories be owned by two groups. That's not possible. It's users who can be part of multiple groups, not files or directories. You simply got it backwards :-)

Answer 3

There are two problematic things in your approach. The first one is:

chgrp god public private
chgrp pub public

With second command, you discarded the effect of the first one. Directory public now belongs to pub group, not to god anymore.

The second thing is that you probably didn't give write permissions on directory public to group that owns it (the fact that the user executing the command touch belongs to directory's group doesn't matter).

Try this:

chmod 770 public

and do similar with other directories. However, what you're initially trying to achieve is impossible because the directory can belong to one group only. Nikos elaborated it well in his answer - place user in more groups.

Answer 4

You will need to use a file system that supports ACLs. As mentioned in other answers, the pub and priv group ownership is possible with the basic Linux permissions, but to grant access to the god group, since files/directories can only have a single group tag, will require an ACL. Most of the current file systems should support this functionality - see the manual pages for getfacl and setfacl .