Let's assume we are in a business environment and we want to configure a *nix/*BSD file server. The business does work for several customers, thus the folder structure has the clients' names on the top level and then different projects in the different customer-folders:
- Customer 1 |- Project 1 |- Project 2 |- ... - Customer 2 |- Project x |- Project y |- ... ...
Furthermore we have different project managers for the different projects and one user group per project.
We want to prevent users that are members of the "Project 2" group from reading/writing/executing stuff in other project folders. That part can easily be achieved with chown and chmod.
My question is as follows: Can we somehow give out permissions to the project managers so that they can manage their respective user groups (e.g. project manager of Project 1 can manage the user group Project 1, but not the other groups) so that they can add or remove users to or from the groups? The thing is that we do not want to hand out unlimited su-access to all the project managers.
Also, it would be a bonus, if we could do this without any additional layer of software.