-1

May someone explain me how to manage rights correctly pls? I have a file with these rights:

8 -rw-r--r--+ 1 sntecard  sntecard    4669 Sep 18 12:34 index.php

I am accessing this folder by user myuser and trying to modify it. Sure, I can't. Ok, I am adding group write rights and add myself to sntecard group (being a root):

usermod -a -G sntecard myuser

chmod g+w index.php

Let's check rights: (ls -ls)

8 -rw-rw-r--+ 1 sntecard  sntecard    4669 Sep 18 12:34 index.php

Now let's check I am in a group: (grep sntecard /etc/group)

sntecard:x:503:sntecard,myuser

Awesome, I am in a group and now SHOULD TO have rights! But NO. I can't write this file. Impossible thru sFTP and impossible ever thru nano index.php. Access error when writting a file.

What I am doing wrong?

P.S. What is that "+" at the end of rights line actually means?

closed as off-topic by Jenny D, Ward, dawud, Cristian Ciupitu, mdpc Oct 14 '14 at 19:59

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Ward, dawud, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You have to login again to make group membership effective. – Tometzky Sep 24 '14 at 5:21
  • @Tometzky I've tried that. I am logging in new SSH session and trying to write file from there. Same effect. – Epsiloncool Sep 24 '14 at 7:30
  • 2
    getfacl index.php to answer "+" question. – Navern Sep 24 '14 at 7:57
2

You should use id to see what your current user and group id's are. Effectively you should log in again to pick up your new group id.

P.S. What is that "+" at the end of rights line actually means?

This is hidden in the info pages (info ls)

Following the file mode bits is a single character that specifies
 whether an alternate access method such as an access control list
 applies to the file.  When the character following the file mode
 bits is a space, there is no alternate access method.  When it is
 a printing character, then there is such a method.

GNU `ls' uses a `.' character to indicate a file with an SELinux
 security context, but no other alternate access method.

A file with any other combination of alternate access methods is
 marked with a `+' character.
2

In the output of the ls -ls :

 8 -rw-r--r--+ 1 sntecard  sntecard    4669 Sep 18 12:34 index.php

The number 8 is the result of the -s option and the size of the file in blocks.

The -rw-r--r--+ are in order the human readable permissions for the user who owns it (-rw), other users in the file’s group (-r-), other users not in the file’s group (-r-), or all users (-).

The trailing + is an indication of more extended access controls. Those can't be displayed by ls and require helper commands. In case of file-systems mounted with the acl option for instance getfacl to display and setfacl to modify POSIX ACL's.

POSIX ACL's will override the simple ugoa permissions used by chmod and chown.

If instead of the trailing plus + a dot . would have been displayed; that indicates SELinux context, requiring the -Z flag in ls to display them.

For completeness, 1 is the reference count, which would be 2 if there was a hardlink to the file and 3 for two hardlinks, etc. For a directory that number is at least two, and increased with each file and/or directory in that directory.

Then owner and the group, followed by the actual file-size in bytes. A directory with size 0 is one not holding any files, such as pseudo file-systems like /proc, /sys and those managed by the automounter by the way. Than the time stamp of the last modification date followed by the actual filename.

0

I have found an answer by myself. "+" means alternative ACL (access lists) set for this file. When we looking at them, we can see

getfacl index.php

# file: index.php
# owner: sntecard
# group: sntecard
user::rw-
user:cyberuser:rwx              #effective:rw-
group::r--
mask::rw-
other::rw-

Which means NO group write access. Change this by

setfacl -m group::rw- index.php

solves an issue.

Not the answer you're looking for? Browse other questions tagged or ask your own question.