97

There is a folder that is owned by user tomcat6:

drwxr-xr-x 2 tomcat6 tomcat6 69632 2011-05-06 03:43 document

I want to allow another user (ruser) write permissions on document folder. The two users (tomcat6 and ruser) does not belong to same group. I have tried using setfacl:

sudo setfacl -m  u:ruser:rwx document

but this gives me setfacl: document: Operation not supported error. Kindly help me.

TheVillageIdiot
  • 1,357
  • 3
  • 17
  • 23

3 Answers3

180

There are two ways to do this: set the directory to "world" writable or create a new group for the two users and make the directory writeable to that group.

Obviously making it world writeable is a Bad Thing, so the second option is preferable.

Users in Linux can belong to more than one group. In this case you want to create a brand new group, let's call it tomandruser:

sudo groupadd tomandruser

Now that the group exists, add the two users to it:

sudo usermod -a -G tomandruser tomcat6
sudo usermod -a -G tomandruser ruser

Now all that's left is to set the permissions on the directory:

sudo chgrp -R tomandruser /path/to/the/directory
sudo chmod -R 770 /path/to/the/directory

Now only members of the tomandruser group can read, write, or execute anything within the directory. Note the -R argument to the chmod and chgrp commands: this tells them to recurse into every sub directory of the target directory and modify every file and directory it finds.

You may also want to change 770 to something like 774 if you want others to be able to read the files, 775 if you want others to read and execute the files, etc. Group assignment changes won't take effect until the users log out and back in.

If you also want (you probably do) that new files created inside the directory by one of the users are automaticaly writable by others in the group, then see here.

leonbloy
  • 655
  • 1
  • 6
  • 18
Andrew Lambert
  • 7,635
  • 3
  • 30
  • 47
  • works like a charm – swapnilsarwe Aug 21 '12 at 19:36
  • 5
    You probably want to also set the set-group-ID flag for directories, to make new files and sub-directories automatically owned by the right group: `sudo find /path/to/the/directory -type d -exec chmod 2770 '{}' \;` – Marcello Nuccio Dec 13 '12 at 14:28
  • 9
    I'd avoid using chmod 770, 775 or whatever. That messes with the permissions of _all_ files. Instead use something like `chmod -R g+w` to add write permissions without mucking up everything else. – Christian Jan 03 '13 at 15:11
  • 2
    If a user creates a new file there (say, mysql by `SELECT INTO OUTFILE`), it sets permissions to its primary group (`mysql` in this case), and the file is not accessible by another user anyway. How to workaround this? – Olexa May 15 '13 at 11:53
  • Found an answer for my question here: http://superuser.com/a/19333/171762 – Olexa May 15 '13 at 12:37
  • Does `-R 770` change permission for all subdirectories AND FILES in that directory? – Jürgen Paul Jun 24 '13 at 10:17
  • @WearetheWorld Yes. – Andrew Lambert Jun 24 '13 at 15:47
  • 3
    What if you want to grant users write access to a folder without changing the folder's ownership e.g. you don't want to mess with apache's permissions on a public_html folder? – codecowboy Feb 12 '14 at 16:45
  • I would not mess around with set-group-ID flag with **chmod 2770** UNLESS you are 100% user you know what that does and what you are trying to do! –  Oct 04 '15 at 13:13
  • 6
    **Note:** "Group assignment changes won't take effect until the users log out and back in." I have missed that :) – Vladimir Vukanac Dec 04 '15 at 11:50
  • What happens if the file was originally owned by `root` instead of `tomcat6`? – ComputerScientist Nov 22 '19 at 17:58
  • I saw in some Linux documents Linux group, such as Debian 10 has limitation and more than 16 users can't add to a group, if we will add more than 16 it is possible by your answer? – Navid Oct 12 '20 at 09:52
  • @leonbloy the question you link to in your edit describes how to use setgid to make sure new files created inside the dir are *owned* by the group. It does not show how to make them "*automaticaly writable by others in the group*" - or am I missing something? – Don't Panic Jun 06 '21 at 09:52
6

Following script shows an example to give r (read) / w (write) / x (execute) permission to the given folder path /path/to/the/directory for USER1 and USER2. If you want to give only write access please replace rwx with w.

#!/bin/bash

# Block others and people in the same group to do `r/w/x` on the give folder:    
sudo chmod 700 /path/to/the/directory 

# Give read/write/execute access to USER1 on give folder:
sudo setfacl -R -m user:USER1:rwx  /path/to/the/directory 

# Give read/write/execute access to USER2 on give folder:
sudo setfacl -R -m user:USER2:rwx  /path/to/the/directory
alper
  • 156
  • 1
  • 13
5

Opinionated anwer:

  • I like to put my shared folder in a central place. Not in someone else's homefolder, but /srv/common or even (for ruthlessly short paths...) /repo or similar.
  • define a new group (typically for all local users, that you want to join in. However not some technical users like wwwuser, unless there's a valid reason)
  • root is good to have as a member, also to have a neutral owner of that shared folder
  • setGid is very important, such that new files do become common group membership, thus frank:common, not frank:frank
    sudo groupadd -f common
    usermod -aG common root
    usermod -aG common frank
    usermod -aG common mike

    # sort of hack for instant group refresh w/o logout
    # superuser.com/a/345051
    su - frank

    # sanity test1:
    cat etc/group | grep common
        common:x:1008:root,frank,mike
    # sanity test2:
    groups
        frank adm cdrom ... common
    sudo chown root:common /repo

    # (if you have shareable stuff setting somewhere else,
    #  copy it to here now)

    # no right to the world, the right rights to user and group
    chmod -R ug+rwXs,o-rwx $dest
    # why uppercase X ? → unix.stackexchange.com/a/416885

    # why s ? → superuser.com/a/277785
    # as there is no such thing as an uppercase S (directories only)
    # settings the s attribute on preexisting content would have to happen
    # like so:
    # find /repo -type d -exec chmod g+s {} \\\;
Frank N
  • 727
  • 7
  • 15