Linux Security Cookbook

5.10. Sharing Files Using Groups

Problem

Two or more users want to share files, both with write privileges.

Solution

Create a group containing only those users, say, smith, jones, and ling:

               /etc/group:
friends:x:200:smith,jones,ling

Create the shared file in a directory writable by this group:

jones$ cd
jones$ mkdir share
jones$ chmod 2770 share
jones$ chgrp friends share
jones$ ls -ld share
drwxrws---    2 jones   friends    4096 Apr 18 20:17 share/
jones$ cd share
jones$ touch myfile
jones$ chmod 660 myfile
jones$ ls -l myfile
-rw-rw----    1 jones   friends       0 Apr 18 20:18 myfile

Users smith and ling can now enter the directory and modify jones’s file:

smith$ cd ~jones/share
smith$ emacs myfile

Discussion

smith, jones, and ling should consider setting their umasks so files they create are group writable, e.g.:

$ umask 007
$ touch newfile
$ ls -l newfile
-rw-rw----    1 smith         0 Jul 17 23:09 newfile

The setgid bit on the directory (indicated by mode 2000 for chmod, or “s” in the output from ls -l) means that newly created files in the directory will be assigned the group of the directory. The applies to newly created subdirectories as well.

To enable this behavior for an entire filesystem, use the grpid mount option. This option can appear on the command line:

# mount -o grpid ...

or in /etc/fstab :

/dev/hdd3   /home   ext2    rw,grpid    1 2

See Also

group(5), chmod(1), chgrp(1), umask(1).