Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have folders on a number of our (debian) servers that require various users (both real and system) to be able to read and/or write. We've come up with a particular file permissioning and ownership model that makes everyone happy but for a variety of reasons, this model comes undone over time as users modify things.

We've tried setting things like the umask and setting sticky bits on the group permission in an attempt to maintain correct permissions and ownerships but these efforts don't tend to be enough.

Ideally, we'd specify our file permissions and ownership model in a configuration file and have a daemon that enforces this model. Does something like this exist?

(Googling would suggest no, but I would prefer not to reinvent the wheel if this has already been solved)

share|improve this question
    
Could you clarify by which means those folders are shared? –  Karma Fusebox Feb 26 '13 at 23:57
    
Sorry, by shared I only mean that multiple users are required to read and write to them (as opposed to folders in a user's home directory, for example). I'm not talking about a network share, etc. –  Torrance Feb 27 '13 at 0:42
    
    
Are you using plain ACL or extended? Such as setfacl/getfacl. –  Serhiy Mar 3 '13 at 6:43
    
Plain ACL. I'm only vaguely aware of the extended ACL, and besides we've managed to make the plain ACL work. It's just a matter of it sticking around. –  Torrance Mar 3 '13 at 19:43

3 Answers 3

up vote 2 down vote accepted

To answer my own question here, I wrote a small daemon which accepts a simple YAML configuration file and then enforces file ownership, group and permissions. It's called enforced (https://github.com/torrance/enforced) — you'll need Go (golang) to build it.

It does an initial search of the folders under configuration and then sets itself up to watch for any file changes, immediately correcting any files that change.

I hope it's of help to someone else.

share|improve this answer

You can use fam (the file alteration monitoring daemon) to be notified whenever a file is modified (that's the reported fam event if access rights are changed). Then you can stat the file, check whether just the mtime has changed or ctime and reset the access rights if necessary.

If it is not required that the users are capable of changing the access rights then you can wait for file creation events instead (much less), change the file owner, reset the access rights and you are done: Never again trouble with this file.

Strange: At least to my knowledge Linux doesn't offer restrictions on access right changes.

This problem could also be used by a FUSE filesystem which just modifies access rights. I don't know whether something like that already exists but there are so many FUSE modules out there that it's worth a check.

share|improve this answer

I think that a bash script running from crontab would be my answer to that singular problem.

Since you stated that file permissions gets messed up from time to time, set a deamon, or even fam, to check for permission changes all the time would be "overkill" (IMHO).

Setting a cron job to run and fix the permissions once a week, or even once a day, would be nice.

share|improve this answer
    
We previously had a cron job doing just this. The main issue is that the permissions/ownership model has become complex enough to need to rewrite the cronjob to much more clever about what it does, which is the step I'm trying to avoid. –  Torrance Feb 27 '13 at 3:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.