LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 05-16-2012, 10:54 AM   #1
jm34003
LQ Newbie
 
Registered: May 2012
Posts: 6

Rep: Reputation: Disabled
Group permissions: user can't access 770 directory even though a member of group


I have 3 users that belong to 3 corresponding groups:

user-russia belongs to group-russia
user-belarus belongs to group-belarus
user-ukraine belongs to group-ukraine.

I also have 3 directories: russia (belongs to “user-russia”), belarus (belongs to “user-belarus”), ukraine (belongs to “user-ukraine”). Each of these directories has permissions rwxrwx--- (full permissions to members of group).

So if I login as user-russia, I can access directory “russia”, but cannot access the other two, and so on.

THE PROBLEM:

I also created “user-all”, and made it a member of groups group-russia, group-belarus and group-ukraine. I expected this user to have access to all 3 directories, since it belongs to all these groups, and each directory has full permissions for members of user group. Meanwhile, whenever I try to access ANY of these directories as “user-all”, I get “Permission denied”.

Ideas?
 
Old 05-16-2012, 11:04 AM   #2
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,260

Rep: Reputation: 118Reputation: 118
That should work.
Did you log in as user-all before you added that user to the 3 groups?
That would explain it - group membership is read at login.
If so, log out & log in again.
If not, or if that doesn't help, return with info about distro, desktop manager, pam, SE-Linux...

Last edited by pingu; 05-16-2012 at 11:05 AM. Reason: Spelling
 
Old 05-16-2012, 11:24 AM   #3
pan64
Senior Member
 
Registered: Mar 2012
Location: Hungary
Distribution: debian i686 (solaris)
Posts: 4,512

Rep: Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222
a user may belong to several groups, but actually it is only member of a given one and he can change this group (from the list)
So there is an actual group selected from the list, by default it is the primary group. If you want to change it you need to use the command newgrp <another group>.
You can check the actual settings by the command id, or by creating a file.
 
Old 05-16-2012, 11:40 AM   #4
jm34003
LQ Newbie
 
Registered: May 2012
Posts: 6

Original Poster
Rep: Reputation: Disabled
pingu,
No, I made that user a member of groups at the time of creation:

Code:
useradd -u 1100 -g group-russia -G group-belarus,group-ukraine -d /var/countries/ -s /bin/sh -m user-all
passwd user-all
Tried logging in and out, but no luck.

System info:

I am running a CentOS relase 5.8. It is actually a remote VPS and I only have console access.
 
Old 05-16-2012, 12:19 PM   #5
jm34003
LQ Newbie
 
Registered: May 2012
Posts: 6

Original Poster
Rep: Reputation: Disabled
pan64,
When I run id as user-all, I get the following:

Code:
uid=1100(user-all) gid=500(group-russia) groups=500(group-russia),501(group-belarus),502(group-ukraine)
So, when I do "newgrp group-belarus", and then id again:

Code:
uid=1100(user-all) gid=501(group-belarus) groups=500(group-russia),501(group-belarus),502(group-ukraine)
The primary group did change, but no effect on permissions. Still get "Permission denied" when cd to any of these directories.
 
Old 05-16-2012, 12:32 PM   #6
pan64
Senior Member
 
Registered: Mar 2012
Location: Hungary
Distribution: debian i686 (solaris)
Posts: 4,512

Rep: Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222
Is that possible the homes are mounted?
 
Old 05-16-2012, 12:44 PM   #7
jm34003
LQ Newbie
 
Registered: May 2012
Posts: 6

Original Poster
Rep: Reputation: Disabled
pan64, no.
I tried creating another directory, which is not home to any user, gave membership to "user-russia" and set permissions to 770. But I still can't access it with user-all.
 
Old 05-16-2012, 01:01 PM   #8
pan64
Senior Member
 
Registered: Mar 2012
Location: Hungary
Distribution: debian i686 (solaris)
Posts: 4,512

Rep: Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222
That sounds strange.
So please write all the commands you executed one by one, and also post the results.
including id <username>, pwd and ls -la
 
Old 05-16-2012, 01:12 PM   #9
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,260

Rep: Reputation: 118Reputation: 118
Try disabling SE-Linux, it might very well be the cause.
Never used it myself but here's a link that seems helpful: http://www.crypt.gen.nz/selinux/disable_selinux.html
 
Old 05-16-2012, 01:35 PM   #10
jm34003
LQ Newbie
 
Registered: May 2012
Posts: 6

Original Poster
Rep: Reputation: Disabled
pingu, I tried doing what you advised, but it doesn't help.

Code:
[root@server selinux]# echo 0 >/selinux/enforce
[root@server selinux]# cat /selinux/enforce
0
[root@server selinux]# su - user-all
-sh-3.2$ cd /var/countries
-sh-3.2$ ls -la
total 20
drwxr-xr-x  5 root          root 4096 May 16 14:19 .
drwxr-xr-x 20 root          root 4096 May 16 10:03 ..
drwxrwx---  2 user-belarus  root 4096 May 16 12:44 belarus
drwxrwx---  2 user-russia   root 4096 May 16 12:44 russia
drwxrwx---  2 user-ukraine  root 4096 May 16 12:44 ukraine
-sh-3.2$ cd ukraine
-sh: cd: ukraine: Permission denied
-sh-3.2$ groups
group-russia group-belarus group-ukraine
-sh-3.2$
 
Old 05-16-2012, 01:47 PM   #11
pan64
Senior Member
 
Registered: Mar 2012
Location: Hungary
Distribution: debian i686 (solaris)
Posts: 4,512

Rep: Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222Reputation: 1222
how is this /var/countries mounted?
 
Old 05-16-2012, 01:52 PM   #12
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,260

Rep: Reputation: 118Reputation: 118
Quote:
Originally Posted by jm34003 View Post
Code:
-sh-3.2$ ls -la
total 20
drwxr-xr-x  5 root          root 4096 May 16 14:19 .
drwxr-xr-x 20 root          root 4096 May 16 10:03 ..
drwxrwx---  2 user-belarus  root 4096 May 16 12:44 belarus
drwxrwx---  2 user-russia   root 4096 May 16 12:44 russia
drwxrwx---  2 user-ukraine  root 4096 May 16 12:44 ukraine
Ha, look at that again: the 3 directories are group root!
They are owned by their respective user (user-belarus, user-russia & user-ukraine) but group is root!
So, "chgrp group-russia russia" etc and you're done!
 
Old 05-16-2012, 02:00 PM   #13
jm34003
LQ Newbie
 
Registered: May 2012
Posts: 6

Original Poster
Rep: Reputation: Disabled
Thumbs up

pingu, THANK YOU!!!
And that was so obvious, I need to get some sleep finally :-)
 
Old 05-16-2012, 02:03 PM   #14
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,260

Rep: Reputation: 118Reputation: 118
Glad to help!
Off to your beauty-sleep now, you deserve it! :-)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Weird directory user group (4294967295) - no access even with root bazeusz Linux - General 5 05-30-2011 11:41 AM
Member of group root, but root group permissions don't apply? aeternitas Linux - Software 7 04-21-2010 11:06 PM
Secondary group users need to change the file permissions of primary group files? sunnybmv Linux - Newbie 3 12-10-2009 04:57 PM
apparent group member can't access directory xuanadoo Linux - Newbie 2 09-14-2006 08:02 PM
Samba User / Group Access Permissions Different Between Linux and Win jeyroz Linux - Software 8 01-29-2006 11:26 AM


All times are GMT -5. The time now is 10:15 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration