1

I have faced a problem in changing the permissions for a specific group of users in my system.

suppose I have four users u1,v1 and u2,v2 and two groups g1 and g2. u1,v1 are in g1 group and u2,v2 are in g2 group respectively.

Now I want a file which is "foo.bar" to be accessible(rwx) only by u1 in g1 group. I typed the following for this purpose:

sudo chown u1:g1 foo.bar
sudo chmod 700 foo.bar

but I have the following questions:

first. What is the usage of giving a file ownership to a group where we can restrict other users using chmod command ?(the third field in file permissions rwx-rwx-rwx ) what is the application of chown here ?

let me give an example for this question: I only want "foo.bar" to be accessible from g1 users and not any users in the system. Can it be done just by using chown command ? if not what is its application !

second. how we can give specific permissions to a specific group ? for example I want g1 group to have only read permission on any files which is owned by it. so when I type the following in the terminal

sudo chown :g1 foo.bar

without any more commands, all the u1 and v1 users have only read permission on this file. is it possible only by chown ?

I hope I made my points clear to you all.

Improve this question
3
  • You first say that you want foo.bar to be accessible only by user u1, then you say you want it accessible by all users in group g1. Commented Jun 28, 2018 at 9:48
  • @Kusalananda, in both scenarios I only want to know the chown application ! I mean I can restrict users by only using chmod command. so why I need to use chown at all ? Commented Jun 28, 2018 at 9:52
  • 1
    Please don't cross-post: stackoverflow.com/questions/51079160/… Commented Jun 28, 2018 at 13:32

2 Answers 2

Reset to default
1

Chown and chmod have two different purposes:

  • chown defines who owns the file.
  • chmod defines who can do what.

  1. To restrict the access to a specific group: the group have to be owner of the file and the permission bits have to be set properly.

    sudo chown :g1 foo.bar && sudo chmod 770 foo.bar

    The 3 last permission bits are related to all other users: Chown command sets ownership. Users that are not owners will be concerned by those 3 last permission bits.

  2. If you want to set specific permissions for a group that is the owner of the file: sudo chmod 770 foo.bar. This can also be set at file creation with umask.

Else, if you want different permissions for each group, you may want to have a look at ACL permissions. This will allow you to set for exemple r-- for g1, rwx for g2 and --- for others.

Improve this answer
0
1

Now I want a file which is foo.bar to be accessible(rwx) only by u1 in g1 group. I typed the following for this purpose:

sudo chown u1:g1 foo.bar
sudo chmod 700 foo.bar

This will give permissions on the file for user u1 (only). The group you've set the file to doesn't really matter since members of the group don't have any permissions set. Or rather, they have exactly the same permissions as "others", so it doesn't matter if a given user access is determined by the "group" permissions or the "other" permissions.

Note that you can't directly require both the user and the group to match. The above file will be accessible to u1 regardless of their group membership.

What you can do, is create a directory owned by e.g. root.g1, accessible only by user and group; and then a file within it that is owned by u1 and accessible only by the user. This is most often done for e.g. crontabs, which are owned by a particular user, but should only be modified by a particular (setgid) tool. See e.g. /var/spool/cron/crontabs/ on any Debian/Ubuntu system.

What is the usage of giving a file ownership to a group where we can restrict other users using chmod command ... I only want foo.bar to be accessible from g1 users and not any [other] users in the system.

You set the file's group to g1, grant any access you like to the group. E.g. chown a.g1 file && chmod 660 file would only let user a and members of group g1 read and write the file. (In addition, user a can change the permissions. If you want to prevent that, you'll need to make the file owned by some user that will not do that.)

how we can give specific permissions to a specific group ? for example I want g1 group to have only read permission on any files which is owned by it.

You can't. The permissions are a property of the file, not the user or group. In the above case, the file was given read/write permissions to the group, so that's what happens. You'll need to take care to not let any files have write permissions for the group, if that's what you want.

[the question from the comment] chown is mainly used for giving ownership to a group so later we can limit the group users to the file by using chmod command yes? otherwise we can restrict all other users except the owner by using chmod alone and there is no need to use chown.

Well, pretty much. Of course, root can use chown to actually change the owning user too, if that's warranted. That will happen at least under the hood when creating a new user: the ownership of the home directory has to be set somehow.

(If the user's primary group is appropriate, you could have a use for chmod without chown, but that's just skipping an unnecessary chown.)

Improve this answer
2
  • Thanks for your answer, your third paragraph was the thing I needed. just one more thing to accept your response as answer. chown is mainly used for giving ownership to a group so later we can limit the group users to the file by using chmod command yes ? otherwise we can restrict all other users except the owner by using chmod alone and there is no need to use chown. Commented Jun 28, 2018 at 10:38
  • @PsP, well, pretty much. But if the default group is something like users that everyone is a member of, then you may want to change the group's access permissions too (or have a directory with 0700 permissions for any private files). I edited the answer a bit. Commented Jun 28, 2018 at 12:41

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.