Force group assignment in chrooted sftp environment

Create a new home directory, such as /chroothome.

Have all users home directories live within that chroothome.

chroot adminuser to /chroothome.

For everything else, just use filesystem permissions.

As far as your "bonus question," it isn't possible using native functionality. The inability for the chroot user to write to the root directory is a security mechanism by design. Of course, you can always modify the source code.

Nevertheless, I suspect you could specify the user's home directory as /user1 and have the working directory at login be the one they could write to.

I solved this by introducing another directory level:

/srv/sftp/user1/data/file1.txt
          ^^^^^ ^^^^
            |     +- user homedir
            +------- chroot target

OpenSSH is now configured to chroot to the directory "user1" preventing the user from breaking out of his own directory. The user homedir is set to "/data" so that the working directory of the user is this one right after the SFTP login.

"user1" has limited access rights as required by OpenSSH, the user has no write access to this directory.

"data" on the other hand belongs to the user and has his primary group along with SETGUID, so that the user can write in this directory and files that are written by the upload user belong to the correct group.