Setting default username and group for files in directory

Question

Using this helpful post I am able to set a default group and file permissions in a folder.

I'm having trouble setting a default owner (teamlead uid 1234).

setfacl -d -m g::rwx /my/test/folder
setfacl -d -m o::rx /my/test/folder

getfacl /my/test/folder

# file: /my/test/folder
# owner: teamlead
# group: web_prod
# flags: -s-
user::rwx
group::r-x
other::r-x
default:user::rwx
default:group::rwx
default:other::r-x

With that:

[mary@boxen]# touch /my/test/folder/somefile
[mary@boxen]# ll /my/test/folder/somefile
-rw-rw-r--. 1 mary web_prod 0 Nov  6 08:58 somefile

So the right group is assigned, but the new file has ownership of the user creating the file. I'd like newly created files to have teamlead:web_prod owner/group.

It appears that setfacl can be used to set a default user, too. With the existing folder acl config (above):

[mary@boxen]# setfacl -d -m u:1234:rwx /my/test/folder

Now to create a file as a different user. I'm expecting it to have teamlead:web_prod ownership.

[mary@boxen]# touch /my/test/folder/anotherfile
[mary@boxen]# ll /my/test/folder/anotherfile
-rw-rw-r--+ 1 mary web_prod 0 Nov  6 08:58 somefile

New file still has ownership of the owner creating the file, not uid 1234(teamlead).

Is what I'm after even possible, or is the way I'm going about this wrong?

Answer 1

With setfacl you can set default permissions but not default owner/group for newly created files.

To get new files to be owned by a specific user, you'd need a setuid bit that works like the setgid bit on directories. Unfortunately that is not implemented.

With setfacl you can do something which is nearly equivalent in most scenarios: You can set an ACL like default:user:teamlead:rwx (e.g. setfacl -d -m u:teamlead:rwx foo). That way the named user can write the new files, even if somebody else owns it.

Answer 2

A new file is always created belonging to the user that the process creating the file is running as. (The effective user ID, to be precise.) This cannot be changed, because allowing users to create files belonging to other users would be security hole, similar to allowing non-root users to give away a file.

Whatever you're trying to do, you don't need to do this. ACLs are sufficient to ensure that whatever will need to read the file later will have sufficient permissions. Leave the file owned by the user who created it.

Answer 3

If you want to that the new files will be created with the new group, you need change the primary group.

For this you can use usermod and the parameter -g

   -g, --gid GROUP
       The group name or number of the user's new initial login group. The group must exist.
       Any file from the user's home directory owned by the previous primary group of the user will be owned by this new group.
       The group ownership of files outside of the user's home directory must be fixed manually.

e.g.

test2@kinakuta:/tmp$ id
uid=1002(test2) gid=1002(test2) grupos=1002(test2),1003(testgroup)
test2@kinakuta:/tmp$ touch test2
test2@kinakuta:/tmp$ ls -la test2
-rw-r--r-- 1 test2 test2 0 nov 23 22:26 test2
root@kinakuta:/tmp# usermod -g testgroup test2
root@kinakuta:/tmp# su test2
test2@kinakuta:/tmp$ touch test2_1
test2@kinakuta:/tmp$ ls -la test2_1 
-rw-r--r-- 1 test2 testgroup 0 nov 23 22:27 test2_1

Answer 4

On Linux you have to have sgid on parent dir to inherit group for files. (Although you don't need sgid on directory on BSD systems.)