Linux – How are r– directory permissions supposed to work on Linux

file-permissionslinux

I have created directory a created has these permissions – the other user has

drwxr–r– 5 user user 4096 2012-09-15 19:30 sites

When do an ls -l on the directory as another user

ls -l /home/user/sites

this is the directory output. I thought without the x bit set on that directory the filenames wouldn't show at all.

d????????? ? ? ? ?                ? dev.user.com  
-????????? ? ? ? ?                ? user.20120914_082804.sql.gz   
d????????? ? ? ? ?                ? shared  
-????????? ? ? ? ?                ? shared.tar.gz  
-????????? ? ? ? ?                ? www.20120914_083256.tar.gz
d????????? ? ? ? ?                ? www.user.com

Is there some inconsistency here?

Best Answer

x gives you permission to actually be in the directory and access the files in the directory, r gives you permission to see the contents of the directory.

If you reversed the situation by giving the directory the x bit and removing the r bit, then the user could open shared.tar.gz (assuming proper permissions on the file itself) but only if he knew the filename in advance since ls would be unable to list the files in the directory.

Related Solutions

Linux – How to Set Up a Shared Directory

What you have actually looks correct. You have the setgid bit set on the directory, so new files created should inherit the staff group. They do still remain owned by the creator, though. I suspect the problem is that the umask for your users is defaulting to 022 or even 077, which means new files they create will not have the group-write permission by default. The user/group ownership is correct, but the group permissions do not permit other members of the group to write (or maybe even read) the files.

Pick a user in the staff group and set the umask to 002 or 007, which means new files will be owner- and group-writable. I suspect this will correct the problem:

bash$ umask
0022
bash$ umask 002
bash$ umask
0002

Also, you noted you don't want anyone outside of the staff group to have any access to the directory at all. You should modify the directory permissions to 2770 to achieve this, otherwise non-staff will be able to read (but not modify) files in the directory.

For the last question about the apache user, the easiest way is probably to add that user to the staff group.

Linux – How to Set Up Permissions for the WWW Folder

After more research it seems like another (possibly better way) to answer this would be to setup the www folder like so.

sudo usermod -a -G developer user1 (add each user to developer group)
sudo chgrp -R developer /var/www/site.com/ so that developers can work in there
sudo chmod -R 2774 /var/www/site.com/ so that only developers can create/edit files (other/world can read)
sudo chgrp -R www-data /var/www/site.com/uploads so that www-data (apache/nginx) can create uploads.

Since git runs as whatever user is calling it, then as long as the user is in the "developer" group they should be able to create folders, edit PHP files, and manage the git repository.

Note: In step (3): '2' in 2774 means to 'set Group ID' for the directory. This causes new files and sub directories created within it to inherit the group ID of the parent directory (instead of the primary group of the user) Reference: http://en.wikipedia.org/wiki/Setuid#setuid_and_setgid_on_directories

Best Answer

Related Solutions

Linux – How to Set Up a Shared Directory

Linux – How to Set Up Permissions for the WWW Folder

Related Topic