Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First of all, thanks for reading. I've had success running a plist launchd job that is in my LaunchAgents folder. It basically calls a small shell script that chmod's a folder's permissions. I then have another job that calls another script that changes it back to what it was before.

Now, I'm trying to figure out how to chmod a folder/file permissions for a particular group. I realize that every folder/file has an owner that belongs to a group. Yes, but how do I explicitly give permissions to another group of users through a shell script? Is this possible? I have also been reading about ACL's, is this the route I should go?

My script is simple now:

chmod -R 777 <FOLDERNAME>

then back:

chmod -R 000 <FOLDERNAME>

Running this while logged in as the administrator.

But I'd like to grant access for another group, in theory:

chmod -R 777 <FOLDERNAME> <GROUPNAME> <-- yup, this is what I'm thinking

share|improve this question
up vote 1 down vote accepted

You need ACLs. First of all, your filesystem must be mounted with that option. You can remount it with that option with:

# mount -o remount,acl /mount/point

If you want this option static (available after each reboot):

# vi /etc/fstab
/dev/partition  /mount/point  fstype  defaults,acl 1 2

The important part here, is ",acl" in the options column. Everything else you can ignore.

The you need to install acl package, and use setfacl. To set defaults for a directory (every new file and subdir created will have those acls):

# setfacl -d -m u::rwx,u:user1:rx,g::rx,g:group1:rwx,g:group2:rx,o::- directory
  • Creation user has full permissions
  • user1 has only read an execute
  • same for default group
  • group1 has read execute and write access
  • group2 read and execute
  • others have no chance in here

You should now, set permissions on this directory (yes, just strip -d option):

# setfacl -m u::rwx,u:user1:rx,g::rx,g:group1:rwx,g:group2:rx,o::- directory

NOTICE that if there are any contents in this directory, permissions MUST be explicitly set. You could use find to set up permissions correctly (remember, directories must have read and execute access for people to access/list them). For a start on that subject, find ./ -type d give you subdirectories in current location and the following will setup default permissions for each one of this:

# find ./ -type d -exec setfacl -d -m <acl> \{} \;
  • <acl> should be the desired acl
  • \{} \; is an escape sequence for find.

If you want to check permissions inherited by created files and directories, use getfacl

You could also use the -R|--recursive switch, but that would mess up with files and directories permissions.

share|improve this answer
Thank you, I'll work on using this solution and get back to you. – gabemartinez Sep 30 '10 at 17:41
@gabemartinez This answer appears to use Linux. Mac OS X uses extended chmod commands to manipulate ACLs not setfacl. Read the chmod man page for more information. – Cromulent Sep 30 '10 at 18:56
Thank you for that! – gabemartinez Sep 30 '10 at 18:57
missed the tag macosx ... sorry – Torian Sep 30 '10 at 20:59
No problem, thank you for reading and responding! – gabemartinez Oct 4 '10 at 1:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.