Permissions

Basic perms

Depending on scripts/processes being run, some only need to read files (read-only), but some need read/write access, to the alternate account

Limitations/Issues

• additional app/process users will all be set to either all read/write access or all read-only access, if both are needed, ACL's must be used (like in some samba env's) * umask may need to be modified where multiple processes are creating files/directories (i.e.; umask settings for both files and directories in samba, umask settings in ftp server configuration, etc.)

Multiple users/processes needing access to a single account

1. Add users to proper group

# usermod -aG appuser nrpe                                                                
OR if you have many users                                                                  
# for U in nrpe snmp cacti applog ; do usermod -aG appuser $U ; done                      

2. Set directory perms so that new files all belong to the same group

read-only
# find /home/appuser -type d -exec chmod g=rxs '{}' ;
read/write
# find /home/appuser -type d -exec chmod g=rwxs '{}' ;

3. Optionally set write access, for read/write option

# find /home/appuser -type f -exec chmod g+w '{}' ;

Single user/process needing access to a multiple accounts

1. Add users to proper group

# usermod -aG buildapp1 scmadmins
OR if you have many users
# for U in buildapp1 buildapp2 ; do usermod -aG $U scmadmins ; done

2. Set directory perms so that new files all belong to the same group

read-only
# find /home/buildapp1 -type d -exec chmod g=rxs '{}' ;
read/write
# find /home/buildapp1 -type d -exec chmod g=rwxs '{}' ;
OR if you have many users
# for U in buildapp1 buildapp2 ; do find /home/$U -type d -exec chmod g=rxs '{}' ; ; done

3. Optionally set write access, for read/write option

# find /home/buildapp1 -type f -exec chmod g+w '{}' ;                                     
OR if you have many users
# for U in buildapp1 buildapp2 ; do find /home/$U -type f -exec chmod g+w '{}' ; ; done

ACL's

Limitations/Issues

• umask may need to be modified where multiple processes are creating files/directories (i.e.; umask settings for both files and directories in samba, umask settings in ftp server configuration, etc.)

Note: m - modify, R - recursive, d - default perms (for new files, as opposed to no -d which would be existing files)

For a directory tree;

Read/write users;

# setfacl -Rm u:joe:rw /home/Shared/Reports
# setfacl -dRm u:joe:rw /home/Shared/Reports

Read-Only users;

# setfacl -Rm u:gary:r /home/Shared/Reports
# setfacl -dRm u:gary:r /home/Shared/Reports

For a file;

# setfacl -m u:joe:rw /home/Shared/Reports/Weekly_Client_Report-20100704.xml

Reference

ls output

# ls -l

getfacl output

# getfacl somedir
  # file: somedir/
  # owner: lisa
  # group: staff
  # flags: -s-
  user::rwx
  user:joe:rwx               #effective:r-x
  group::rwx                 #effective:r-x
  group:cool:r-x
  mask::r-x
  other::r-x
  default:user::rwx
  default:user:joe:rwx       #effective:r-x
  default:group::r-x
  default:mask::r-x
  default:other::---

chmod details/usage

The format for chmod's symbolic mode used in this doc is [ugoa...][[+-=][perms...]...]

The letters 'ugoa' control which user/group/etc the access to the file or directory will be changed
'u' (user) permissions for the user who owns the file/directory (u)
'g' (group) permissions for other users who are members of the group (g)
'o' (other) other users that are not in the group permissions (o) (aka world readable)
'a' (all) all of the above                                                                
The '+-=' operators control how the permissions are set on the file or directory
'+' (add) causes the selected permissions to be added to the existing permissions
'-' (remove) causes them to be removed
'=' (set) causes them to be the only permissions

The  letters  'rwxXst' select the new permissions for the affected users:
'rwx' (r) read, (w) write, (x) execute (or search/access for directories)
'X' execute/search only if the file is a directory or already has execute permission for some user
's' set user or group ID on execution
't' restricted deletion flag or sticky bit