We have folders on a number of our (debian) servers that require various users (both real and system) to be able to read and/or write. We've come up with a particular file permissioning and ownership model that makes everyone happy but for a variety of reasons, this model comes undone over time as users modify things.

We've tried setting things like the umask and setting sticky bits on the group permission in an attempt to maintain correct permissions and ownerships but these efforts don't tend to be enough.

Ideally, we'd specify our file permissions and ownership model in a configuration file and have a daemon that enforces this model. Does something like this exist?

(Googling would suggest no, but I would prefer not to reinvent the wheel if this has already been solved)

  • Could you clarify by which means those folders are shared? Feb 26, 2013 at 23:57
  • Sorry, by shared I only mean that multiple users are required to read and write to them (as opposed to folders in a user's home directory, for example). I'm not talking about a network share, etc.
    – Torrance
    Feb 27, 2013 at 0:42
  • Are you using plain ACL or extended? Such as setfacl/getfacl.
    – Serhiy
    Mar 3, 2013 at 6:43
  • Plain ACL. I'm only vaguely aware of the extended ACL, and besides we've managed to make the plain ACL work. It's just a matter of it sticking around.
    – Torrance
    Mar 3, 2013 at 19:43

3 Answers 3


To answer my own question here, I wrote a small daemon which accepts a simple YAML configuration file and then enforces file ownership, group and permissions. It's called enforced (https://github.com/torrance/enforced) — you'll need Go (golang) to build it.

It does an initial search of the folders under configuration and then sets itself up to watch for any file changes, immediately correcting any files that change.

I hope it's of help to someone else.


You can use fam (the file alteration monitoring daemon) to be notified whenever a file is modified (that's the reported fam event if access rights are changed). Then you can stat the file, check whether just the mtime has changed or ctime and reset the access rights if necessary.

If it is not required that the users are capable of changing the access rights then you can wait for file creation events instead (much less), change the file owner, reset the access rights and you are done: Never again trouble with this file.

Strange: At least to my knowledge Linux doesn't offer restrictions on access right changes.

This problem could also be used by a FUSE filesystem which just modifies access rights. I don't know whether something like that already exists but there are so many FUSE modules out there that it's worth a check.


I think that a bash script running from crontab would be my answer to that singular problem.

Since you stated that file permissions gets messed up from time to time, set a deamon, or even fam, to check for permission changes all the time would be "overkill" (IMHO).

Setting a cron job to run and fix the permissions once a week, or even once a day, would be nice.

  • We previously had a cron job doing just this. The main issue is that the permissions/ownership model has become complex enough to need to rewrite the cronjob to much more clever about what it does, which is the step I'm trying to avoid.
    – Torrance
    Feb 27, 2013 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.