permissions vs group

[dandi]

Hi Everyone,

I have a problem with accessing directory by the user that has a full access to this directory. So here is my setup:
there are two regular users: dkitel and cosiek and group called local.
cosiek wants to share /home/cosiek/1 directory to dkitel giving full access to local group(group that dkitel belongs to)
------
from cosiek standpoint it looks like this:
------------------------

[cosiek@plk-dkitel-fedora-01 ~]$ ls -l /home/
total 28
drwxrwx---. 6 cosiek local 4096 2010-11-28 04:42 cosiek
drwx------. 36 dkitel dkitel 4096 2010-11-28 04:23 dkitel
drwxrwx---. 6 gucio gucio 4096 2010-11-28 04:30 gucio
drwx------. 2 root root 16384 2010-10-05 00:21 lost+found
[cosiek@plk-dkitel-fedora-01 ~]$ ls -l /home/cosiek
total 8
drwxrwx---. 3 cosiek local 4096 2010-11-28 04:42 1
drwxrwxr-x. 2 cosiek cosiek 4096 2010-11-28 04:42 2
[cosiek@plk-dkitel-fedora-01 ~]$ ls -l /home/cosiek/1/
total 4
drwxrwx---. 2 cosiek local 4096 2010-11-28 04:42 1.1
[cosiek@plk-dkitel-fedora-01 ~]$



------
from dkitel standpoint it looks like this:

[dkitel@plk-dkitel-fedora-01 home]$ cat /etc/group | grep local
local:x:503:dkitel,gucio
[dkitel@plk-dkitel-fedora-01 home]$ groups dkitel
dkitel : gucio dkitel local
[dkitel@plk-dkitel-fedora-01 home]$ cd /home/cosiek/1
bash: cd: /home/cosiek/1: Permission denied
[dkitel@plk-dkitel-fedora-01 home]$ ls -l /home/cosiek/
ls: cannot open directory /home/cosiek/: Permission denied
[dkitel@plk-dkitel-fedora-01 home]$

--------------------------
and now my question: why dkitel does not have access to /home/cosiek/ ?
dkitel belongs to local group and /home/cosiek directory is fully accessible for local group

Thank you,
Daniel

[assen]

Hi,

dkitel needs to log out and log in again before his new group comes info effect.

Also, is SELinux on?

WWell,

[amturnip]

Troubleshooting could start with seeing whether dkitel can:

ls /
ls /home

[Fenrin]

Hello,

here is a solution:

su
chmod -R g+rw /home/cosiek/

To explain this command: -R changes the permission of the whole directory including every contained file; g=group, + adds permission, r=read, w=write.


In case if local group was not the owner of /home/cosiek, also do this:

chown -R :local /home/cosiek/

chwon changes the ownership of files. Syntax is as follows chown user:group files.

[jpollard]

Originally Posted by Fenrin

Hello,

here is a solution:

su
chmod -R g+rw /home/cosiek/

To explain this command: -R changes the permission of the whole directory including every contained file; g=group, + adds permission, r=read, w=write.


In case if local group was not the owner of /home/cosiek, also do this:

chown -R :local /home/cosiek/

chwon changes the ownership of files. Syntax is as follows chown user:group files.

Only if you want to give everything to the group.

You need access to the home directory - which may not be
granting group access.

Now if cosiek does not want to share his home directory, then
you may have some problems. It is possible to give some
permissions to the group for the home directory:
r- grants read (you can list the contents)
w- grants write (you can create files)
x- grants the ability to search for a specific file, but not read
the directory for all files.

The minimum the cosiek home directory will need:

owner- rwx, group- x, world-none
The directory /home/cosiek/1, will need owner-rwx,
group-rwx, world-none.

This will allow any member of the group "local" the ability
to read/write/create files in the /home/cosiek/1 directory,
but they will NOT be able to see what other files are in
the /home/cosiek directory.

[Fenrin]

ok thanks jpollard for the corrections.

I also noticed just now (I tried something similiar on my computer) that with above command of my post the user dkitel could not access subfolders of /home/cosiek/. In nautilus it would show files below /home/cosiek but you could probably not access these files.

[dandi]

assen, thanks a lot !!! login out and login in helped indeed.

Originally Posted by jpollard

Only if you want to give everything to the group.
The minimum the cosiek home directory will need:

owner- rwx, group- x, world-none
The directory /home/cosiek/1, will need owner-rwx, group-rwx, world-none..

yes, I checked this and there must be x flag assiged to the local group for /home/cosiek directory at minimum to narrow down shared area (/home/cosiek/1 in this case) and to gain security.
that makes sense

thanks a lot guys !!!