Use ACL and SGID to make a group of users to work on the same directory and Linux file permission

Jephe Wu - http://linuxtechres.blogspot.com

Objective:  a parent directory called /shared is owned by db2inst1 (umask 022 only),  and 2 other users called jephe and zhitan are going to work on the this directory /shared. They should be able to read/write any files and directories under /shared each other, also be able to read/write files created by db2inst1 which means any files created by db2inst1 will have group-writable permission although its umask is 022.

Environment: RHEL 5 or CentOS 5

Preparation:
You can mount the partition with acl option by using 'mount / -o remount,acl'.
or

cd /path/to/directory; df . -> find out which mount directory, let's say it's /data, then mount /data -o remount,acl



Steps:
1. configure the permission 
When a new file is created on a Unix-like system, its permissions are determined from the umask of the process that created it.

[root@linuxtest /]# ls -ld shared  (let its group to have write permission so that jephe and zhitan can create files and directories under /shared, but any files created by db2inst1 itself will not be group writable because its umask is 022)
drwxrwsr-x 2 db2inst1 its 4096 Feb 20 10:22 shared

[root@linuxtest /]# usermod -G its jephe
[root@linuxtest /]# id jephe
uid=500(jephe) gid=500(jephe) groups=500(jephe),502(its)
[root@linuxtest /]# usermod -G its zhitan
[root@linuxtest /]# id zhitan
uid=501(zhitan) gid=501(zhitan) groups=501(zhitan),502(its)

 2. configure default acl permissions
[root@linuxtest /]# setfacl -d -m u:jephe:rwx,u:zhitan:rwx /shared
[root@linuxtest /]# setfacl -R -m u:jephe:rwx,u:zhitan:rwx /shared

Note:
The default ACL will be applied only for newly created files or directories under /shared directory. If you use only setfacl -d for the parent directory and user jephe and zhitan are still not able to write for this directory,

[root@linuxtest /]# getfacl shared
# file: shared
# owner: db2inst1
# group: its
user::rwx
group::rwx
other::r-x
default:user::rwx
default:user:jephe:rwx
default:user:zhitan:rwx
default:group::rwx
default:mask::rwx  (the mask defines the maximum permissions that can be given to users or group, if it's --x, means the user and group can get maximum permission is --x, if the user or group itself doesn't have x permission, then mean user and group will get effective permission as ---, aka nothing)
default:other::r-x

Now, any files or directories created by db2inst1 will have group writable permission although the umask for db2inst1 is 022, this is different from the case before setting setfacl. Also, user jephe and zhitan will be able to create files or directories under /shared.

or you can just set up mask permission as rwx, then any files created by db2inst1 will have group write permissions.
[root@linuxtest /]# setfacl -R -m d:m:rwx /shared  (modify mask as rwx)

A directory may contain default ACL entries. If a file or directory is created in a directory that contains default ACL entries, the newly created file will have permissions generated according to the intersection of the default ACL entries and the permissions requested at creation time. The umask will not be applied if the directory contains default ACL entries.

--------------umask explanation by example--------------
[root@linuxtest /]# setfacl -m m:r-- shared  (set shared directory itself mask as r--)
[root@linuxtest /]# getfacl shared
# file: shared
# owner: db2inst1
# group: its
user::rwx
group::rwx                      #effective:r--
mask::r--
other::r-x
default:user::rwx
default:user:jephe:--x
default:group::rwx
default:mask::rwx
default:other::r-x

[root@linuxtest /]# setfacl -d -m m:r-- shared  (set default mask as r--, means for any newly files/directories created under it )
[root@linuxtest /]# getfacl shared
# file: shared
# owner: db2inst1
# group: its
user::rwx
group::rwx                      #effective:r--
mask::r--
other::r-x
default:user::rwx
default:user:jephe:--x          #effective:---
default:group::rwx              #effective:r--
default:mask::r--
default:other::r-x
[root@linuxtest /]# ls -ld shared
drwxr-Sr-x+ 7 db2inst1 its 4096 Feb 20 13:18 shared

------------------end------------------------------------


3. remove all acl permissions
setfacl -R -b /shared

To remove all the permissions for a user, group, or others, use the -x option and do not specify any permissions:

setfacl -x <rules> <files>

To remove all permissions from the user jephe

setfacl -x u:jephe /shared

Linux file permissions:

Any program uses system calls to access files and directories.

1. directory:
You can imagine directory is like a datafile which conains a table, each row has filename and its inode number:

Read:  
This permissioin can only find out the name of the files under it , not inode and not other things stated in inode data structure

.

Write:  
This permission allows you to add, rename, or delete files within, not modifying file directly like

# echo testing > file1 

# > file1

But vim can modify files. The following is from http://vimdoc.sourceforge.net/htmldoc/editing.html 

*write-readonly*
When the 'cpoptions' option contains 'W', Vim will refuse to overwrite a
readonly file.  When 'W' is not present, ":w!" will overwrite a readonly file,
if the system allows it (the directory must be writable).
 

Also, all above actions also require changing or at least reading the inodes of the affected files, 

so search permission is also needed to add/rename/delete files within

Execute: 
This permission means search, grants the ability to traverse its tree in orde to access files/subdirectories. 

It's required to access the "inode" information of the files within.


2. File:
Read: system call read()
You need to get file's inode number to read it.
Only file owner or root user can modify information in the inode such as the owner and group name and permissions.

Write:system call write()  to modify file content

Execute: system call  exec()
If file is a program, you can only need x without r to execute that program, but if the file is a shell script, 

you also must have r permission to execute it. The proper permissions on a script are both read and execute

Example: cat /home/jephe/file1, firstly you need to have read permission for file1 to read the content, then 
you need x permission on / /home /home/jephe to locate inode of file1and thus to read it. 

References:

a. Unix File and Directory Permissions and Modes - http://content.hccfl.edu/pollock/AUnix/FilePermissions.htm

b. http://en.wikipedia.org/wiki/Filesystem_permissions 

Use Openssh chroot and ACL to make user to delete files under certain folder

Jephe Wu -  http://linuxtechres.blogspot.com


Objective: let normal user accounts to be able to delete all files under /usr/local/tomcat/files/ directory and chroot to /usr/local/ after sftp.
Environment: CentOS 5.4, openssh 5.X, /usr/local/tomcat and all subdirectories are owned by tomcat:tomcat


Challenges:
1. default CentOS 5.4 doesn't come with the version of Openssh which is able to do chroot.
2. openssh internfal-sftp chroot requires all components of the pathname must be root-owned directories that are not writable by any other user or group, so we cannot chroot to /usr/local/tomcat/files directory, as tomcat is owned by tomcat , not root.
3. /usr/local/tomcat/files is owned by tomcat, not user accounts. So, although we can chroot to /usr/local/, we still need to let user acounts to be able to delete files.


Approach:
1. install the latest openssh 5.X
2. use chroot feature with internal-sftp, user can only use sftp, not shell, and chroot to /usr/local after that since /usr/local is owned by root.
3. use acl feature to set acl to be able to write for folder /usr/local/tomcat/files, but not able to list files under /usr/local/tomcat

Steps:
1. download and install openssh 5.x  (./configure;make;make install to /usr/local/)

or you can check this page to install compiled RPM:

http://linuxadminzone.com/quickly-upgrade-ssh-openssh-in-centos-linux-to-latest-5-5-version/


2. configure /usr/local/etc/sshd_config as follows:
Subsystem    sftp    internal-sftp   [-u 0002]
Match group chrooted
         ChrootDirectory /usr/local/
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp [-u 0002]

Note: -u 0002 to specify umask for user after login, you can give 
/usr/local as root:sftp -R and 755 -R
/usr/local/XXXX as apache:sftp -R  and chmod 775 -R and chgrp g+ws XXXX -R

so that 2 users can share the work on the project.

Note: if you want to setup a chrooted sftp only environment for all users belongs to sftponly group. You  can do this:

Match   Group sftponly                                                                                                       
        ChrootDirectory %h                                                                                                   
        ForceCommand internal-sftp                                                                                          
 

or

Match   Group sftponly                                                                                                       
        ChrootDirectory /sftponly                                                                                                
        ForceCommand internal-sftp                                                                                           
 

note: You can give root:sftponly permission to /sftponly directory, if you'd like

to restrict users from writing to that folder, don't give write permission for group.

or create a subfolder under /sftponly then give write permission to that subfolder only, instead of parent folder. 

3.create user account jephe:
useradd jephe 
groupadd chrooted
usermod jephe -G chrooted

4. mount the partition which the folder /usr/local/ belongs to with acl options


5. set acl for user jephe
setfacl -m u:jephe:x /usr/local/tomcat/
setfacl -m u:jephe:rwx /usr/local/tomcat/files

Note: so, now user jephe is able to delete any files under /usr/local/tomcat/files, but cannot list any other files under /usr/local/tomcat directory. User can configure winscp to direct switch to /tomcat/files(/usr/local becomes / after chroot for user)