I have a home volume with fifty or so home directories in it which each corresponding user can write to as you would expect. I need to give one user (DATA) the ability to write to each of these directories; would this best be accomplished by giving DATA its own group and allowing DATA's group write access to these folders? Am I over-thinking this?

Thanks,

M

If you want to stay out of the way of the regular users' use of the directoris then ACLs are probably the best way even if they are a bit confusing.

Otherwise you can use the group permissions.

You are not overthinking this and basically it is correct. You would need to set the group ownership of all home directories to data. And then, make all directories group writable.

You can create a new user data, belonging to the data group. He will have write access to all home directories. You don't need to create that user data, you can add any user to the data group.

A slight problem is that ordinary users do not belong to the data group. If they would, everyone would have wrote access to all home directories. But if they are not member of the data group the newly created files do not have group ownership by data and cannot be written by the data group.

In order to make sure every file created in that directory has data groupid, you should set the sticky bit on the user's directory.
jlinkels

I thought home directories had to be owned by the user.

A couple of thoughts here:
First, should all files be group writable by DATA?...or only those files DATA writes?
If the latter, I disagree with jlinkels...don't set the sticky bit for group DATA...
Otherwise, their advice looks sound...
But...
How will the "ordinary user" be able to read files created by the DATA user? Do they even need to?
or...more to the point...
What exactly are you trying to accomplish? [This is known as the "Tim D. Memorial Question" where I came from. ]

Why does the user DATA need to write to other user's directories ?

I don't see that anyone is proposing a change in the ownership of the user's home directories...

The user directories and files remain owned by the user. Group is set to data. Directories and files must be group writable.

jlinkels

1 members found this post helpful.

This is exactly what I was trying to accomplish, thank you. This box acts as a file hub of sorts for a bunch of ETL processes and one of our remote technicians discovered that he could traverse the directories in /home which isn't a good idea.

Thanks everyone!

So, that means ownership would need to be user:group where 'user' is not a member of 'group'? Can you do that?

Yes, that is perfectly possible. Look at this example. gemerenciana is not member of the adm group. Still she is able to create files which belong to the adm group. The next problem is that she has a umask of 022. Which should be changed to 002 if files must be group writable. The setgid only makes the group ownership stick.

The idea behind this is that a user co-operating to a project would make his files group writable. Either automatically by changing the umask. Or on purpose to give his group members access.

If you realize how Unix was designed, for which purpose and that the world was not as evil as it is now, it makes perfect sense.

Directory:
Create a file
Group membership:
Owner changes the group permissions while she is not member of that group:

jlinkels

1 members found this post helpful.