I have tow user in same group 1. user 1 : datauser 2. user 2 : webuser 3. Group : apache

What set permission using setfact to either of user can create directory/file recursive.

Ex.: directory /web/foo/ What permission/mask set (using setfact), so that datauser/webuser can create directory under foo dir (recursive).

#datauser : mkdir -p /web/foo/datadir/
#webuser : mkdir -p /web/foo/datadir/webdir
#datauser : touch /web/foo/datadir/webdir/datafile.txt
#webuser : touch /web/foo/datadir/webfile.txt

I try with below command, but when any directory created using      
webuser:apache, then datauser:apache not able to write under that.

setfacl -Rm u:webuser:rwX,d:u:webuser:rwX foo
setfacl -Rm u:datauser:rwX,d:u:datauser:rwX foo
setfacl -Rm m:rwX,d:m:rwX foo

That umask and chmod not work.
[datauser]$ mkdir foo
[datauser]$ chmod g+ws foo
[datauser]$ umask 002 foo

[datauser]$ getfacl foo
file: foo
owner: datauser group: apache
flags: -s-

Now create directory using webuser:apache user [PHP : mkdir(/web/foo/browser, 0755, ture); ] And directory permission is: [datauser]$ getfacl foo/browser/ file: foo/browser/
owner: apache
group: apache
flags: -s-

Now create file under browser dir. getting permission denied.

[datauser]$ touch foo/browser/command.txt
touch: cannot touch ‘foo/browser/command.txt’: Permission denied


How about using chmod g+ws /web/foo? This sets the setgid and write bits on the directory, which makes all created files' groups to be apache in that directory, and allows all apache group users to write to that directory and create further directories inside it.

And another thing that you need to do is to update your umask so that group has write permissions by default. So, you should add umask 002 somewhere in your startup files so that group gets write permissions by default.

  • In that newly created directory not able to write... dir created using webuser /web/foo/webdir/, datauser not able to create dir under webdir. – Jignesh Jul 2 '15 at 13:46
  • I updated the answer, you also need to add write bit for the group. – Tero Kilkanen Jul 2 '15 at 15:02
  • Another updated, added umask – Tero Kilkanen Jul 2 '15 at 23:10
  • That also not work... update in main question. – Jignesh Jul 3 '15 at 4:39
  • umask has to be set in every shell session startup, that is, add umask 002 command somewhere in your shell startup scripts. The problem in your attempt is that the second shell session has the standard 022 umask, which means group doesn't get write permission. – Tero Kilkanen Jul 3 '15 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.