Taming Shared Directories: A Practical Guide to Avoiding Permission Headaches with setgid, Sticky Bits, and ACLs

Managing Shared Directories in Linux

I’ve seen permission management become a real headache when working with shared directories in Linux. Multiple users and groups need to access the same files, but with different levels of permission. To tame these shared directories, you can use setgid, sticky bits, and Access Control Lists (ACLs).

Understanding setgid

The setgid bit is a special permission that allows a directory to inherit the group ownership of its parent directory. This is useful for shared directories where multiple users need to collaborate on files. I usually start with setting the setgid bit on a directory using the following command:

chmod g+s /path/to/directory

For example, let’s create a shared directory called projects and set the setgid bit:

mkdir /projects
chmod g+s /projects

Now, when a new file is created in the projects directory, it will inherit the group ownership of the projects directory. Don’t bother with manually setting the group ownership for each new file - setgid takes care of it for you.

Using Sticky Bits

Sticky bits are another special permission that can be used to control file deletion. When a sticky bit is set on a directory, only the owner of a file can delete it, even if other users have write permission to the directory. This is where people usually get burned - they think that just because a user has write permission, they can delete files. To set the sticky bit on a directory, use the following command:

chmod +t /path/to/directory

For example, let’s set the sticky bit on the projects directory:

chmod +t /projects

Now, even if multiple users have write permission to the projects directory, only the owner of a file can delete it.

Access Control Lists (ACLs)

ACLs provide a more fine-grained way to control file permissions. With ACLs, you can set specific permissions for individual users or groups, in addition to the traditional owner, group, and other permissions. The real trick is to use ACLs in conjunction with setgid and sticky bits to create a robust permission system. To set an ACL on a file or directory, use the setfacl command. For example, let’s set an ACL on the projects directory to give the dev group read and write permission:

setfacl -m g:dev:rwx /projects

You can also use the getfacl command to view the ACLs on a file or directory:

getfacl /projects

This will display the ACLs on the projects directory, including any default ACLs that may be set.

Default ACLs and Troubleshooting

Default ACLs are used to set ACLs on new files and directories created in a directory. To set a default ACL on a directory, use the following command:

setfacl -d -m g:dev:rwx /projects

This will set a default ACL on the projects directory, so that any new files or directories created in it will inherit the ACL. In practice, this means you can ensure that new files and directories have the correct permissions without having to manually set them each time. If you’re having trouble with ACLs, make sure to check the POSIX Access Control Lists documentation on kernel.org for more information.

Practical Tips

When working with shared directories, I’ve found that following a few simple best practices can make all the difference:

Use setgid to inherit group ownership on directories.
Use sticky bits to control file deletion.
Use ACLs to set fine-grained permissions on files and directories.
Set default ACLs on directories to ensure new files and directories inherit the correct permissions.

By following these tips and using the tools and techniques outlined in this article, you can effectively manage shared directories and avoid permission headaches.