Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to figure out how to setup the permissions on a directory (/apps) so both the root user, and another user justin can read, and write into the directory.

The user justin is part of the group devs.

/apps has permissions of drwxrwsr-x, with owner root and group devs. Additionally it has gid set; chmod g+s /apps

The problem is, with the root user if I touch a file (test) inside /apps the owner is root and group is devs. The permissions on the file is -rw-r--r--. If I switch to the user justin and try and modify test I get permission denied.

Basically, what is the best way to achieve this? I want it where root can create directories and files, and justin can read and write those files and directories. This needs to be automated, as files and directories are created it just works, doing a manual update of permissions is not an option.

share|improve this question

1 Answer 1

You have better part of the solution figured out, the only thing left to do is correct permissions for things created by root. There are at least two approaches

  1. You can modify the root-side process to call chmod after modifying a file. I do not think it is applicable to your case, because then you'd probably just call chown and chmod and didn't set up sgid directory.

  2. You can modify umask for the root process. I think it would be better to modify umask just for this process, not for root environment, because sometimes root touches files other users shouldn't mess with, and it's usually better to remember to open access than to close gaps. Therefore, you could add umask 0007 in front of call to the binary that runs as root.

share|improve this answer
    
Is there a way when root, and creating a file or directory, to force the owner to be justin instead of root. I think that would solve the problem as well. –  Justin Sep 2 '11 at 5:22
    
To change file owner you can run chown, but it would have to be run after each file creation. If you can automate that, then great. You can set umask for a process, and then you don't need changing file ownership after its creation by root. Choose whichever you like :). –  Paweł Brodacki Sep 2 '11 at 5:40
    
If I simply set umask 0002 how long does that last? Until I logout? Until I restart the server? –  Justin Sep 2 '11 at 5:57
    
It works in the shell, in which it was invoked, until the shell terminates. If you want to change it for all root logins, then edit /etc/bashrc, but I would recommend against it. umask 0022 for root is there for a cause. –  Paweł Brodacki Sep 2 '11 at 6:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.