0

Given one Linux server, and many Linux clients, I need to export some shared directories from the server. The behavior I want to obtain is really simple: a group of users can use a shared space on the server, without having to worry about the existence of UNIX file permissions. If I were in a Windows world, I would just share the directory as r/w, add the users to the permission list, and boom, it's done.

But, in the Linux world, I don't know how to obtain this:

  1. Each shared directory can be mounted only by a subset of users, identified by a group (user/groups/logins are all handled through centralized LDAP). So eg. the share "/var/foobar" on the server must be accessible (read/write) only by members of LDAP group "foobar".
  2. Users must be able to create/modify/delete directories, files, etc. on the share with full access, provided they are in the right group.
  3. Users must be unable to screw permissions of files/directories in a share in a way that other users of the share cannot access them anymore. Big stress on an unable.

The problem with requirement #3 is that there are many Linux applications that like to screw permissions by ignoring the umask and/or forcing a chmod/chgrp after touching a file. Notable examples are Nautilus and OpenOffice.

Failed experiments:

  • NFS: tried in different ways, but if I squash I cannot authenticate, and if I authenticate and user tries to copy a directory with Nautilus, permissions are screwed.
  • NFS + ACL setgid. Still screwable through standard desktop programs doing standard operations that somehow end up forcing a chmod or chgrp.
  • sshfs/sftp-server: there doesn't not seem to be a simple way to avoid calls to chmod/chgrp. There is a patch floating around that allows to block chmod/chgrp but it returns errors to the client that complains to the user. Looks like I could patch the patch to silently ignore chmod/chgrp, but I am already using SFTP on that server for other reasons and there does not seem to be a simply way to define different behaviors for different directories.

Would Samba help somehow? Other solutions?

Improve this question

2 Answers 2

Reset to default
0

Samba with force group and force create mode could work.

Improve this answer
0

It sounds like you are looking for NFS + user-id mapping, to be found in NFS v4 with per-user mounts. Don't share the mount between users, each get's their own mounted as their user with squash.

Improve this answer
5
  • NFS v5? I don't think that exists.
    – sciurus
    Jun 6, 2011 at 18:30
  • Fair enough. But it will :)
    – Caleb
    Jun 6, 2011 at 18:32
  • How can I make sure an user doesn't create a file 0700?
    – Giovanni Bajo
    Jun 6, 2011 at 18:40
  • They can! But that file will then be 0700 for everybody as their respective users.
    – Caleb
    Jun 6, 2011 at 18:45
  • I'm sorry but I don't follow. Can you provide a link or a less terse description of the setup you're hinting at?
    – Giovanni Bajo
    Jun 6, 2011 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .