0

I understand that some products and tools need to have extremely granular permissioning, but what about the underlying filesystem? In a related question, I asked about filesystems than closely compare to NTFS for granularity of permissions support natively.

The classic Unix permissions, read|write|execute for user|group|other, are great. But it seems that they fail when a user is part of more than one group, and a file needs to be accessible to both groups he's in, but no one else (so rw-rw-r-- is "bad" in this instance). A symlink could be created wherein the other group could read it, or a 'parent' group could be created to hold both of the ones the user is in, and have the file ownership be user:parent rather than user:boy, because then the user:girl group couldn't see it.

What good workarounds to this have you seen/implemented?

2 Answers 2

2

I think NTFS gets the balance almost exactly right with a good and simple basic set of options but also giving the possibility to dive in quite deep, but only if you need to. I've always found the Unix system to be overly simplistic (although this is probably as a result of Unix's heritage as a programmer's OS from the 70s rather than a deliberate dumbing down) for the reasons you've outlined, and am not a fan of hacks to work around those limitations. My experience of hacky workarounds is that they tend to evolve into business-critical technical strategies while not really changing in implementation.

2
  • 4
    The NTFS permission system is reasonably well designed and I really like it. My beef with NTFS comes mainly from the major implementation defect that inheritance isn't calculated in real-time but rather is done through ACEs placed on files "in the background. I do wish that NTFS had the concept of an inherited rights filter (one of the few things I actually like about Netware), because it would make some types of permission hierarchies much easier to design. Nov 13, 2009 at 14:55
  • 1
    Good point, I'd forgotten about Netware. I remember the good old days of Trustee Directory Assignments from 3.1; was really simple to use and gave full info on what a user or group actually had access to. Nov 13, 2009 at 16:48
1

For my personal sanity, permissions are best applied only at a directory level. So strictly speaking, I think any "file permissions" are too granular and I try to avoid them whenever possible.

With that out of the way, I apologize but I'm puzzled by

"when a user is part of more than one group, and a file needs to be accessible to both groups."

As you said, classic unix permissions don't allow a "file" to be owned by more than a single group. Can't you just create an extra group with the users making up "both groups" and set that group as the group for the directory holding the files?

Example:

# ls -laZ .
drwxr-xr-x  root parent                                  .
<snipped for clarity ignore>
drwxrwx---  root boy                                     boy
drwxrwx---  root parent                                  common
drwxrwx---  root girl                                    girl

# tail /etc/group
parent:x:8525:b1,b2,crossdresser1,g1,g2
boy:x:8526:b1,b2,crossdresser1
girl:x:8527:g1,g2,crossdresser1

Does this fit your scenario? And is it a good workaround? It's what I've done for years and I'd love to know if it's good. :)

2
  • interesting approach. I think it still fails on the "I only want user1 and user2 to access something, but I don't want to make a new group for just them when they're already part of 'boy', 'girl', and 'parent'", though
    – warren
    Jan 21, 2010 at 15:52
  • Interesting? I'll take that. True. Assuming classical permissions, I don't see how you can avoid creating a new group without resorting to symlink(s) and tedious and tedious permissions on the directories containing those links and the data. Also, for N users where N is 2, the symlinks might be OK. But for N>2, it could get weird and IMHO is far less maintainable that an extra group. I hate shared files. Users should keep their files in one directory on their C drive and use SneakerNet for everything else.
    – iPaulo
    Jan 21, 2010 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .