Group permission inheritance and umask

Question

Edit: in my case virtual_use_local_privs=TRUE did the trick.

i'm trying to force newly created files and directories inside foo/ directory to be owned by nginx user and to set the right permissions so nginx group users can execute and modify them if needed.

The whole thing is i've just configured vsftpd service where my virtual users act as vsftpd user, where vsftpd is a real user with no shell.

After login, each user is chrooted on a directory owned by user vsftpd and group nginx. To accomplish that i created the chroot directory:

mkdir chroot/ 

and then gave the default permissions:

chown -R vsftpd:nginx chroot/

and then enabled SGUID:

chmod -R g+s chroot/ 

Right here, when a vsftpd user creates a directory default permissions are vsftpd:nginx but default permissions for files are nginx:nginx which is not what i want.

Then, as i need nginx user's group to run and modify files if need i setted umask '0022' through vsftpd config but i think i'm going in the wrong way. Can anyone point me to the right direction?

Thanks in advanced!

Edit:

The setfacl command helped a lot, but i'm still having issues with umask.

I run setfacl -R -m d:u:vsftpd:rwx,d:g:nginx:rwx,d:m:rx,d:o::r chroot/ where getfacl chroot/ returns:

# owner: vsftpd
# group: nginx
# flags: -s-
user::rwx
group::rwx
mask::rwx
other::r--
default:user::rwx
default:user:vsftpd:rwx         #effective:r-x
default:group::rwx              #effective:r-x
default:group:nginx:rwx         #effective:r-x
default:mask::r-x
default:other::r--

but uploading new files leaves the following permissions -rw-------+ 1 vsftpd nginx 25 feb 7 13:14 info.php

Note umask setting on vsftpd.conf is set to 1002

Where am i going wrong? Thanks a lot!

Answer 1

You will probably have to use acl's to get the user to always be set to nginx. You would mount the filesystem with acl option, then use

setfacl -m d:u:nginx:rwx,d:g:nginx:rw chroot

(or rw if you don't need executable). Then all files created in the dir will have additional perms giving nginx ownership (even if the primary owner, that shown when ls is used, is a different user).