Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Given one Linux server, and many Linux clients, I need to export some shared directories from the server. The behavior I want to obtain is really simple: a group of users can use a shared space on the server, without having to worry about the existence of UNIX file permissions. If I were in a Windows world, I would just share the directory as r/w, add the users to the permission list, and boom, it's done.

But, in the Linux world, I don't know how to obtain this:

  1. Each shared directory can be mounted only by a subset of users, identified by a group (user/groups/logins are all handled through centralized LDAP). So eg. the share "/var/foobar" on the server must be accessible (read/write) only by members of LDAP group "foobar".
  2. Users must be able to create/modify/delete directories, files, etc. on the share with full access, provided they are in the right group.
  3. Users must be unable to screw permissions of files/directories in a share in a way that other users of the share cannot access them anymore. Big stress on an unable.

The problem with requirement #3 is that there are many Linux applications that like to screw permissions by ignoring the umask and/or forcing a chmod/chgrp after touching a file. Notable examples are Nautilus and OpenOffice.

Failed experiments:

  • NFS: tried in different ways, but if I squash I cannot authenticate, and if I authenticate and user tries to copy a directory with Nautilus, permissions are screwed.
  • NFS + ACL setgid. Still screwable through standard desktop programs doing standard operations that somehow end up forcing a chmod or chgrp.
  • sshfs/sftp-server: there doesn't not seem to be a simple way to avoid calls to chmod/chgrp. There is a patch floating around that allows to block chmod/chgrp but it returns errors to the client that complains to the user. Looks like I could patch the patch to silently ignore chmod/chgrp, but I am already using SFTP on that server for other reasons and there does not seem to be a simply way to define different behaviors for different directories.

Would Samba help somehow? Other solutions?

share|improve this question
add comment

2 Answers 2

Samba with force group and force create mode could work.

share|improve this answer
add comment

It sounds like you are looking for NFS + user-id mapping, to be found in NFS v4 with per-user mounts. Don't share the mount between users, each get's their own mounted as their user with squash.

share|improve this answer
    
NFS v5? I don't think that exists. –  sciurus Jun 6 '11 at 18:30
    
Fair enough. But it will :) –  Caleb Jun 6 '11 at 18:32
    
How can I make sure an user doesn't create a file 0700? –  Giovanni Bajo Jun 6 '11 at 18:40
    
They can! But that file will then be 0700 for everybody as their respective users. –  Caleb Jun 6 '11 at 18:45
    
I'm sorry but I don't follow. Can you provide a link or a less terse description of the setup you're hinting at? –  Giovanni Bajo Jun 6 '11 at 20:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.