Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With Linux ACL, can you have multiple groups with default access to a folder? I want this for sharing code repositories between different coding groups + several processes. My thinking is, if a user from one group creates contents inside the shared repository, even though the owner is that user, the default permissions are propagated to that new file and the other users can still access the contents.

Here's what I tried as root:

mkdir /tmp/temp
chmod 770 /tmp/temp
setfacl -dm g:www-data:r-x,g:sambashare:r-x /tmp/temp
getfacl /tmp/temp

# file: temp
# owner: root
# group: root
user::rwx
group::rwx
other::---
default:user::rwx
default:group::rwx
default:group:www-data:r-x
default:group:sambashare:r-x
default:mask::rwx
default:other::---

As testuser

id
uid=1004(testuser) gid=1007(testuser) groups=1007(testuser),110(sambashare)
cd /tmp/temp
bash: cd: temp: Permission denied

So clearly not working as I expected. Can anyone help me understand why it's not working and how I can fix this?

P.S. I'm setting default group permissions instead of just the regular group permission because those are supposed to propagate to children.

 setfacl -m g:sambashare:r-x /tmp/temp
seems to work to grant access.

Thanks.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Try running setfacl -Rdm g:www-data:r-x,g:sambashare:r-x /tmp/temp and setfacl -Rm g:www-data:r-x,g:sambashare:r-x /tmp/temp. Option d sets the defaults, for new files and directories, but does not change existing settings as seen that only root:root has access. -R will be handy to go recursively down existing directories making the required changes.

share|improve this answer
    
At the moment I only created and tested 1 folder /tmp/temp, so there's no point recursing into it because it's empty? Also I don't want to keep running setfacl -R or chmod -R all the time, as users create contents. That's why I wanted to use default groups. –  Budric May 17 '12 at 18:40
    
I think I see my mistake. Default permissions are applied to newly created files, not used as "default" thing that's checked first. Your suggestion works. –  Budric May 17 '12 at 18:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.