[SOLVED] Setgid bit on a directory

moraxu · 04-02-2013, 11:56 AM

Hi,

I've a question regarding setting setgid bit on directories. According to this page:

Quote:

The setgid bit, 's' or 'S' if there is no corresponding group 'x' bit, influences the creation of new files in the directory. New files are created with their group ID set to that of the directory; the same is true of new directories but in addition they have the setgid bit set. (Not all systems do this.)

The point of this is to make working with groups easier. If all the files created in a group's working directory automatically have the right group ID then other members of the group will be able to access them provided they are created with the right permission bits. The latter can be fixed manually, but it is more convenient to set each user's umask to 002 or 007 (to make all new files group writable). Each user needs to have their own private group, sharing name and number with their user ID, to avoid having to constantly change umask (or leaving all their private files accessible to whatever their default group is).

Could somebody explain me the meaning of text in bold? What does a user's primary group have to do with umask builtin?

shivaa · 04-02-2013, 12:18 PM

Whenever a directory has SGID set on it, any new file or subdirectory created within it will inherit the group of the parant directory. And only those users will be allowed to access the directory or create new files/directory inside it, who are member of the main group of the directory.

So, those users should have umask set in such a fashion that any new file/dir. created by them should get write permission for group, so other group members can also access or modify the file/dir. created by that user.

rknichols · 04-02-2013, 04:27 PM

And just to elaborate further, if users did not each have a private group (as in old versions of UNIX where all users had "users" as their primary group), then having a umask that allowed group read and write permission would mean that all users could read and write your private files. You would, for privacy, have to keep a umask that disallowed group access and change your umask whenever you were working in a directory that was intentionally shared by a group. That's not a practical solution.