how to every file/directory in a tree to have the same owner, group, perms, acls?

Question

playing with a scilinux 6.1 box. fs is ext4 with acls enabled.

If I have a directory, say /pub, that I want everything in it to always, without exception have a predefined owner, predefined group, predefined set of permissions and a predefined set of acls, no matter who copied the file/directory/whatever in, no mater if it gets mv'ed in, no matter nuthin'.

Basically, any file/directory in the 'top' directory (/pub in the case of /pub, src in the case of /usr/src, html in the case of /var/lib/html, whatever) will -always- be owned:grouped by the owner:group of the top directory, no matter how it gets there, no matter who tries to change it. And the permissions will always be whatever the permission set is, no matter what or how, and the acl set will always be the same, no matter what/where.

How do I configure that?

I know this must be an FAQ, but dipped if I can get it.

Answer 1

You can't. Use extended ACLs to provide the permissions you need (with defaults to apply them to all new files) and effectively ignore the traditional permission bits.

Answer 2

You can use the "set group id" feature with chmod g+s /pub to force the group to be the same for all files and directories added to that directory, but "set user id" (chmod o+s /pub) doesn't work on most systems.

Answer 3

You can't. One option that may work for you would be to set up a cron job to periodically run a chown -R, chgrp -R and chmod -R on the entire directory structure to recursively set the owner/group/permissions as you would like them. It's definitely a kludge, and will be a lot of work for very large directory structures, but it will fix the permissions.

You will need to supply the owner/group/permissions to the commands, and the top-level directory to operate on for those commands to work, such as chown -R nobody /tmp/testdir.

Alternately, you could set up a program using inotify to watch the directory for changes and then check or correct permissions as necessary, but inotify has it's own set of problems, especially if there are many nested sub-directories... You have to subscribe to change notifications on all of those directories...

Sounds like @womble's answer is the best bet, but I haven't used extended ACLs. Just wanted to give a few alternatives.

Answer 4

One dirty way of doing it is mounting FAT filesystems and use uid= gid= for it. That way you there won't be a way of changing owner of any file simply because the filesystem doesn't support users, groups or ACLs.

You can test it with something like the commands listed below:

dd if=/dev/zero  of=/var/pubfs bs=1024 count=40960 # Create a file to test it
mkfs.vfat -F 32 /var/pubfs # Format it as FAT32
mount -t vfat -o uid=user,gid=group /var/pubfs /pub # Mount it