mkdir as another user based on configuration file

Question

We have a shared Linux environment where most files are mounted to many machines on a NFSv3 share, which we do not control. Since we only have basic filesystem permissions available (No ACLs), we are looking for a way to allow people to run mkdir in a shared disk without giving the entire group write permissions over the root of the share.

For example, a binary with the setuid bit set, and the owner of the binary set to the owner of the share, could read a configuration file which would define which users or groups are allowed to create a directory in said shared directory. Then it could decide if the user that runs the binary is allowed to create a directory in the share.

The permissions on the top level share would be:

drwxr-x--- 1 owner group …

So the idea is that there is a wrapper for mkdir that then runs as the share owner, checks a configuration file, and creates the requested directory if the configuration file allows it. That way, the users can’t just run the built in mkdir.

The directory created would look something like this:

drwx------ 1 normaluser group 4096 Nov 3 18:14 newdir

Is this the best approach? Or are we reinventing the wheel?

Answer 1

Set the umask as each user logs in:

umask 002

Thereafter, the group will have the same permissions as the user:

mkdir newdir
ls -ld newdir
drwxrwxr-x+ 1 roaima roaima 0 Nov  3 22:04 newdir

If that isn't what you want, then create an alias for mkdir

alias md='mkdir -m 775'
md newdir