Read & Read/Write Groups

[Damien Harrod]

I am trying to achieve a solution to a (hopefully) simple scenario.

I have a Solaris 9 server that is going to be used for sharing files.

I would like to create 'shared' directories. Each directory will have
permissions assigned for two groups; one of these groups will give members
read access, the other group will give members read/write access.

Any new files created in the directory should 'inherit' these permissions.
Any file written should be able to be modified by any member of the
Read/Write group.

I realise that I will need to make use of acl's in order to achieve this
model, although I am not entirely sure how to go about doing this...

So far I have done the following:
mkdir /share
chown WriteGroup /share
chmod 2770 /share
setfacl -m 'group:ReadGroup:r-x' /share

This isn't quite giving me what I am after though.... :-(

Any suggestions, comments or requests for clarification(s)?

Thanks,
Damien

[Scott Howard]

Damien Harrod <anonymous@mail.com> wrote:

> I would like to create 'shared' directories. Each directory will have
> permissions assigned for two groups; one of these groups will give members
> read access, the other group will give members read/write access.
>
> Any new files created in the directory should 'inherit' these permissions.
> Any file written should be able to be modified by any member of the
> Read/Write group.
>
> So far I have done the following:
> mkdir /share
> chown WriteGroup /share
> chmod 2770 /share
> setfacl -m 'group:ReadGroup:r-x' /share
>
> This isn't quite giving me what I am after though.... :-(

It would probably help if you explained what wasn't working, but...

I'd guess the problem you're having is that files (old or new) are not
readable by someone in ReadGroup?
The problem is that you're only setting the ACL on the directory, not on
the files within it. You'll need to do 2 things to fix this :

1. Set the ACL on all files which currently exist within the directory.
setfacl supports the -r option, so your command above with -r should do
this for you.

2. Setup a default ACL on the directory, so that all new files created will
also have this ACL set. man setfacl has details on setting a default ACL.

The other option is to give all files within the directory world read
access, and just put the ACL on the directory.. This way the directory
will basically act as a "gate", allowing only users in ReadGroup and
Writegroup through the gate, at which point the permissions on the files
themselves will handle who can read/write from there.

If that's not the problem you're having how about giving us a few more
details on what the problem actually is?

Scott