1

Using CentOS 4.6:

Scenario: I have a dameon running as root that is constantly creating files and folders in lets say directory /some/directory. Since the files are being created by root, the permissions of those folders and files are determined by the root's umask, which is the default 644 for files and 755 for folders.

I have an application that accesses these files via samba and needs to be able to copy and delete the files. The samba username the application is using is mapped to a user let say 'app_user' which is unable to delete the files because of the permissions. I have added 'app_user' to the group 'app_group'

This is what I would Like to do:

I am hoping there is some way to configure the directory /some/directory so that all files and folders created are owned by the group 'app_group' and have write permissions for that group.

I do not have the option to run the dameon under a different username and I do not want to mess with the umask for root. I would prefer a solution that does not involve running a script to change the permissions. I just want my application to be able to copy and delete these files.

Thanks

4 Answers 4

3

I'd go the POSIX ACLs. I'm a big fan of them and I don't find them all that difficult to use. The only think you really need to make sure is that your backup software can restore them.

The steps should be:

1) Edit fstab and add ",acl" to the options for the partition(s) you want to use ACLS on

2) Run the following to remount the partition with the new acl option

mount <relevant_partion> -oremount

3) Run the following to apply the default acl to the directory and it's child dirs:

setfacl -R -dm u:app_user:755 /some/directory

4) Run the following to check the default acl has appeared:

getfacl /some/directory 

Further testing create a file and a dir in /some/directory and make sure they end up with the acl and in the case of the dir, the default acl,. so that file created inside it will also get the acl

2

I think you can try to use POSIX ACLs to obtain what you need. Search the documentation about the Default ACL that is basically the ACL that will be applied to objects created under the directory where the default ACL is active.
Apply a Default ACL allowing your app user to do stuff to the files on the directory and it should work, unless there are some restrictions about default ACLs and root created files (I can't remember if there are), so try it and see if it work.

To use ACL you need your file system to support it and sometimes for it to be enabled at mount time (-o acl on mount or acl option on fstab). I think SAMBA also needs some extra config to recognize ACLs, but I know it does (we use it at work).

EDIT: Also be sure to read all the ACL documentation, it's not a trivial thing to use.

1

chgrp app_group /some/directory; chmod g+s /some/directory will arrange for files and directories to get the group ownership of the directory. Beyond that, I would start the other script with a different umask (umask 775; exec my-daemon). (This does not propagate the setgid bit, though.)

Other possibilities include changing the group the daemon executes as (since there isn't a standard sg command, I would do this with a Perl or Python wrapper) or using POSIX ACLs (setfacl). Using the latter may require that the filesystem in question be mounted with the acl option on some Linux distributions.

2
  • I'm considering the option of running daemon under different umask. When you say 'This does not propagate the setgid bit' - you're just saying using the umask by itself won't be enough, but as long as I also run chmod g+s then it should work fine right?
    – J Cooper
    Mar 30, 2011 at 3:08
  • No, I mean that a directory created in a g+s directory will get the correct group but will not itself be made g+s, so files created within that directory won't inherit the group. POSIX ACLs deal with this by providing masks of permissions and ownership that will be inherited by files and directories, rendering the setgid thing unnecessary; but some Linux distributions (I don't know about RHEL/CentOS specifically) don't support POSIX ACLs out of the box.
    – geekosaur
    Mar 30, 2011 at 3:13
1

You have a few options you can use:

  • Change the umask using umask 002 or some other appropriate value before running the command. This can be done in the script running the daemon so that it doesn't change roots default.
  • Also use newgrp in the script to change the group to the same group as the app_user uses or another group the app_user and root share. You may have to add root and/or app_user to the group you choose.

  • Create a samba share for this directory that only app_user can access. Use force user root or force group root to enable access to delete the files.

  • Enable POSIX ACLs and create an ACL that allows app_user appropriate access to the files.

You may choose to combine some of these options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .