1

Server: Debian

I am user1, with directory /home/user1/website/logs I want to give a new user, called user2, read access to files located in /home/user1/website/logs without giving user2 access to anything else within user1's home directory and without setting up a shared directory.

How could this be accomplished if possible, or is it impossible?

EDIT: In addition, I need to keep permissions of all files contained in /home/user1/website/logs constrained such that world never has any permissions to it. It needs to just be accessible to the users on the server.

Jonathan Rauscher
  • 11
  • 1
    @jasonwryan The answer there is very vague and only gives a descriptive background on how permissions work. It does not give assistance to this specific scenario. Unless I'm misunderstanding the answer there. – Jonathan Rauscher Jul 11 '16 at 01:00

1 Answers1

1

Assuming you have root access and user2 does not, you could set this up with classic UNIX permissions in the following way. You create a group for this access scheme (probably put both user1 and user2 in it, although for the access control you only need user2 in it), below I'll refer to it by the name rdlog. After you have the group, the following commands should set up what you want:

chgrp rdlog /home/user1 /home/user1/website /home/user1/website/logs
chmod g=x /home/user1 /home/user1/website
chmod -R g=r /home/user1/website/logs

By setting just the x bit in the directory permissions, only exact references in those directories can be used. That means anyone in rdlog can list or cd to the logs directory. And with readonly permission on that directory and the files in it. This does have a number of limitations.

The first is that part of the security is security through obscurity. While you don't give permission to list the directory /home/user1, if there is a file in there it can still be referenced, if they guess the name (but then the file's permissions come into effect). So, for example, they could type cat /home/user1/.bashrc and determine from the error they get (no such file vs. permission denied) whether that file actually exists.

The second limitation is that you only get to do this once. If you need to give a different user access to something else under your homedir, you can't do the same trick, because you can have only one group setting.

You could also do something with ACLs. That could avoid the limitations, if you do it right. However, you might actually achieve your desired goal (i.e. the real question that made you ask this one), by moving the directory in question some where else, where you can do the permissions really right. If you still need to see it when you refer to ~/website/logs you can put a soft link from there to the new location.

MAP
  • 585