Linux permissions between two applications that both need read/write

[-]

evild4ve@reddit

use setfacl to give 33:33 read/write to the directory

[-]

HurtFingers@reddit (OP)

Doesn't look like setfacl can apply to bind-mounted directories? "Operation not permitted"

[-]

zoredache@reddit

Set your ACLs on the host, instead of from within the container.

[-]

evild4ve@reddit

consider:-

- don't bind-mount it (if that's redundant in the overall circumstance), or
- use a Docker volume instead (if it's for isolation)

[-]

deeseearr@reddit

1) Add both users to a common group or groups.

2) Have group read/write permissions added to all files and directories you want to access. No need to "switch groups", you will always have access as long as one of the groups you are a member of has permissions.

3) (Optional) Learn how the "setuid" and "setgid" permission bits apply to directories -- On Linux based systems, "setuid" does nothing while "setgid" means that all files created within the directory will be owned by the same group as the directory entry. For systems derived from BSD the setgid behaviour is the default while the "setuid" bit also forces newly created files to be owned by the user who owns the directory.

[-]

HurtFingers@reddit (OP)

I had a hard time with this because despite users being members of a group, the permissions set on the directory for group permission wouldn't apply unless the group was set as the user's "primary" group, or newgrp <group name> was executed from a shell session. I, too, expected to be able to simply usermod -aG <group name> <user> and grant that user permissions to a directory owned by that group set with chmod 770, but alas, no dice. Even with the sticky bit (setgid).

Thanks for taking the time to write this out though. I just couldn't get it to work properly. I wonder if it's got to do with this occurring across two machines? I.e. does 1000:1000 represent the same 1000:1000 on a different machine? I don't know.

[-]

nekokattt@reddit

yes the numbers are the same, they are the internal representation. If it was going by name then no, it'd be different.

[-]

zqpmx@reddit

Group permissions?

[-]

mysterytoy2@reddit

This.

[-]

michaelpaoli@reddit

So, typically for situation like this, leverage a common group, with both users being a member of that group (need not be primary), and set umask accordingly, to be able to share read, write, and/or execute permissions as desired. Then for the directory itself, SGID on the directory, so any items created within the directory will have the same group ownership (the one common to the two users) as the directory. Likewise set at least x permission for the group, and r and/or w as desired - r will let them read the contents of the directory itself, thus, e.g. list straight from directory, or match files by wildcard - without that they need have/know the specific path of the item within the directory, and w will let them add/remove/rename items in the directory. If you don't want 'em to be able to remove/rename items that have user ownership of the other user, set the sticky bit on the directory. Don't have either user own the directory unless you want them to be able to screw around with those directory permissions. Can likewise do same for any (recursively) subdirectories thereof - if one wants same permissions and access capabilities for those too.

Can do more with, e.g. SELINUX, ACLs, etc., but the above can be done with mere bog standard *nix permissions alone.

[-]

planeturban@reddit

ACLs. Look it up.

/your friendly, grey haired, Unix admin. :)