Share a shelf with a group

Prepare the shelf first. Changing the group is something only root can do.

~ $ suPassword:~ $ addgroup team~ $ chgrp team \    /home/learner/shared~ $ chmod 770 /home/learner/shared~ $ exit~ $ ls -ld shareddrwxrwx--- 2 learner  team  40 shared

drwxrwx---. Everything for the owner (you) and the group (team), nothing for everyone else.

Did you notice the paths were written out in full? Because root's ~ is /root. Type chgrp team ~/shared and it goes looking for /root/shared and says there is no such thing.

While you are root the meaning of ~ changes. That is easy to get wrong, so writing the path out in full is safe.

Put taro in team and he can write to the shelf.

~ $ su taro~ $ echo hello > \    /home/learner/shared/taro.txt~ $ exit

It went through. taro was judged on the group's slot and got rwx.

What about jiro, who is not in team?

~ $ su jiro~ $ ls /home/learner/sharedls: can't open  '/home/learner/shared':  Permission denied

He cannot even look inside, because the slot for everyone else is ---.

That is the decisive difference from chmod 777. 777 lets everybody in; 770 opens it only to the people who need it.

Chapter 6 called 777 too strong a medicine because this choice exists.

Look at the file taro left.

~ $ ls -l shared-rw-r--r-- 1 taro taro  16 taro.txt

The group is taro, not team.

Why? Because the group of a newly made file is the maker's main group. Remember id -gn taro giving taro last lesson.

That is awkward. The shelf is shared as team, and the contents belong to taro. Nobody else can touch them on team's standing.

There is a mark that solves it: setgid (chmod g+s), typed while still root.

/home/learner $ chmod g+s \    /home/learner/shared/home/learner $ exit~ $ ls -ld shareddrwxrws--- 2 learner  team

Where the group's x was there is now an s. It means "things made in here inherit this box's group".

As a number that is 2770, the leading 2 being setgid.

Make something after setting setgid and the group comes out team. And you still cannot write to each other's files.

~ $ ls -l shared-rw-r--r-- 1 taro team  10 taro2.txt

The group is team. But the permissions are -rw-r--r-- (644). The group's slot has no w.

Readable and not writable. That is no good for adding to something together.

The cause is the umask of chapter 6. The default 022 drops the w from the group and everyone else.

666 - 022 = 644

So when working on a shared shelf you change the umask.

~ $ umask 002~ $ echo ... > shared/joint.txt~ $ ls -l shared/joint.txt-rw-rw-r-- 1 taro team ...

664. The group kept its w. Now at last you can write to each other's files.

Let us gather it up. Sharing needed two devices.

Either alone falls short.

• setgid only — the group lines up with no w
• umask only — there is a w and the group is wrong

Do both and you finally get a file anyone in team can read and write.

This is a setting you use as it stands on a real server. Places several people touch nearly always have these two built in.

drwxrws--- team  the shared shelf-rw-rw-r-- team  the files inside

See that shape and you can read it as "this is a place for working together".

One more thing to check. You can remove taro's file.

~ $ rm shared/taro.txt~ $

It goes through, even though taro.txt belongs to taro.

The reason is from chapter 6. What removing needs is the box's w, and the file's own permissions have nothing to do with it.

You own the shelf and hold rwx, so you can remove what is inside.

On a shared shelf that can be a problem, because anybody can remove anybody's files.

What you use there is the sticky bit (chmod +t), named in passing at the end of chapter 6. This too is typed while still root.

/home/learner $ chmod +t \    /home/learner/shared/home/learner $ exit~ $ ls -ld shareddrwxrws--T 2 learner  team

Set it and only the owner can remove what is inside. Remember /tmp being drwxrwxrwt? That is the mark that stops people removing other people's files in a place anybody can write to.

Today you set the shelf up before each question. Here is the routine.

su               -> fulfledgeaddgroup teamchgrp team /home/learner/sharedchmod 2770 /home/learner/sharedexit

It looks long, and everything in it is what you have typed in chapters 6 and 7.
taro and hanako are made with the same adduser as last lesson.

There are three numbers to remember.

When you are stuck, ls -ld, ls -l and whoami. Who you are and how things stand tells you what to type next.