1 Paul says...

You'll be wanting Access Control Lists then. :)

Posted at 4:10 p.m. on March 20, 2008

2 Brendan says...

....err...what Paul said, only here's an article on their usage. It's a bit dated, but I think it's still accurate.

Posted at 4:13 p.m. on March 20, 2008

3 mish says...

I think you want to do

chown writeuser:readgroup testdir

don't you?

Or it is much simpler if it can be world readable:

chmod a-w+rx,g+rwx,u+rwx testdir

And I believe selinux implements ACLs, so any distro that support selinux would do that.

Posted at 5:32 p.m. on March 20, 2008

4 Michael B. Trausch says...

Also a bit dated, here is a document on POSIX Access Control Lists on Linux, which is rather informative.

Posted at 5:42 p.m. on March 20, 2008

5 The Mighty Buzzard says...

You'll probably also want to set a proper umask for anyone in the writegroup group if you're dead set on using basic file permissions.

Like the other guys said though, ACLs are really the way to go for this.

Posted at 5:59 p.m. on March 20, 2008

6 Zeth says...

Mish, sadly, the idea was to make the directory not readable to everyone, only to those in the two groups.

Setting it to writeuser:readgroup doesn't help as writeuser was just an example of a possible user in the writegroup.

For the rest of you, thanks for your comments, but I said "How do we achieve this using basic Unix permissions?", I knew about ACLs but they look horrible and I wanted to work out if it is possible with just Unix permissions.

Posted at 3:59 a.m. on March 21, 2008

7 Duncan says...

Have you tried hard-links?  You are probably familiar with symlinks aka soft-links.  Hard-links have an additional restriction in that they must be on the same filesystem, but the ownership and permissions are assigned to the link, not the data it points to, so it's possible to point multiple hard links each with its own set of permissions at the same on-disk data.

Simplest both for users and to administer is probably to create two directories, say readdir and writedir, setting their group and permissions appropriately.  Then create/copy/move the files into writedir, and hard-link (using the ln command, without the -s switch you've likely become used to using) them into readdir as well, again setting the groups and permissions appropriately.

While just that much will suffice if the same set of files are reused over time, if your usage involves dynamic file creation and deletion, keep in mind that both links must be dealt with.  (Conceptually, editing an existing file edits the file itself, while creating or deleting one edits the directory entry, that is, the link, for the file.  Thus, since each link is separate, editing them is two separate directory edit operations.  That's good since it's actually the feature we are using to get the different permissions.) If creating/deleting the files is routine, consider automating the task with a script (or code it directly into the application if that's what you are doing) that manages both links with a single command.  Of course, if it's a preexisting binary doing the creation/deletion directly, and you don't have source or modify rights to that binary, that may be easier said than done, but that's what free/libre and open source software is all about. =8^)

See, no ACLs necessary after all!

Duncan

Posted at 1:45 p.m. on March 24, 2008

8 John says...

Duncan, sadly the permissions are stored with the data (inode), not with the directory entries (hard-links). Zeth needs ACLs -- no way to do this with basic unix permissions.

Posted at 7:21 p.m. on July 23, 2008

9 Cam McKenzie says...

OpenSuSe and SLED / SLES support advanced ACL's.

It allows for multiple groups and users all to have different rights

man setfacl and getfacl

Posted at 10:38 p.m. on January 18, 2009