File permission

[ust3]

In my system , there is a share directory that many users who are in different groups will write , create , modify , remove the files , I would like to ask if I want all users ( whatever group they are ) can do anything to the files in this share directory , what can i do ?

Thx.

[Pete Randall]

It sounds like the only thing you can do is set 777 permissions and hope for the best. You should also monitor this directory's growth because it's highly unlikely that the users will clean up after themselves.


Pete

[Ivan Krastev]

Grant read/write permissions to all on that directory. If you want add sticky bit as well - this will preserve someone to delete files, created from other users.

regards,
ivan

[Srikanth Arunachalam]

Hi,

The phrase sticky bit, has some sense to its name.

If it is set on a file, then that file will remain in memory after execution, thus â stickingâ in memory. This is useful when running a multi-user program (such as a bulletin board system that I ran once) to make the program execute faster for the next user. This was a common programming tactic earlier in the history of computer programming when speed and disk space were at a premium.

Actually if you have shared folder you might want to create seperate sub-folders with ACL access (setacl) set on it, freezing the 777 permission on the upper directory.

To render a directory private, the simplest command is:

fs setacl -d DIRNAME -clear -a MYNAME all

To explicitly give public read/lookup access, use:

fs setacl -d DIRNAME -a system:anyuser read

Thanks,
Srikanth

[ust3]

thx replies,

the permission of this directory is 777 , anyone can create file to it , but the problem is when user A created a file to it , another user can modify this file as the file mode is 644 or some are 444 , what I want is ALL users can create , modify , remove ALL files ( includes existing file that created from others ) , can advise what can i do ? thx

[James R. Ferguson]

Hi:

> what I want is ALL users can create , modify , remove ALL files ( includes existing file that created from others ).

Then you need to have the FILES permissions set to -rw-rw-rw- so that any user (owner, group member or not) can read and write them.

The DIRECTORY permissions determines who can read, write and search the directory. Set the DIRECTORY permissions to drwxrwxrwx. Do NOT set the 'sticky' bit on the directory since this means that only the owner of a file can delete it.

Your users will have to set their 'umask' to 000 (or the 'umask' of the process that creates files) such that any files that are created will have default permissions of 666 (-rw-rw-rw-)

Regards!

...JRF...

[Roberto Arias]

hi

try with chmod 1777

[ust3]

thx reply,

Your users will have to set their 'umask' to 000 (or the 'umask' of the process that creates files) such that any files that are created will have default permissions of 666 (-rw-rw-rw-)


that is good , but have problem , first , I need to change at least 200 users' profile , second , if do that , all their files will be changed to 666 ( except the shared directory) , can adivse .. thx

[Dennis Handly]

>need to change at least 200 users' profile,

Change only /etc/profile. And if users also have it in their .profile, tell them to change it. You could of course write a script to do the changing, so it wouldn't matter how many.

>all their files will be changed to 666

I don't see any good ways.
You could have a cronjob that just sleeps and wakes up and chmod all files in that directory to a+rw.

[Matti_Kurkela]

An user can be a member of several (secondary) groups simultaneously, but a file can belong to one group only.

You can create yet another group and make all the users that are required to access the share directory members of that group. For example, let the name of the group be "sharegrp".

Then set the group ownership of the share directory to "sharegrp" and set "chmod g+rwxs" to the directory.

Now all the group members can access the directory. Furthermore, the setgid bit on the directory will cause any new files created in that directory to be owned by the sharegrp group. Any new subdirectories will get both the sharegrp group ownership and the setgid bit.

Now you can set the umask to 002 or 007, and the users will find that it "just works".

The users should know one trick, though:
if someone accidentally creates a file that is not owned by the sharegrp, they may not be able to modify its contents. This may happen if someone extracts files from an old tar package while preserving file permissions, for example.

However, the directory permissions will allow the users to rename or delete the offending file. If the user can read the file, he/she can do this:

mv problemfile problemfile.old
cp problemfile.old problemfile
rm problemfile.old

You should also note that root ignores all file permissions, including the setgid setting. If a shared directory is set up like this, it's actually better to not be root when manipulating its contents.

MK