What permissions should be set for shared directory in Linux

Including the question comments, your current situation seems to be:

drwx------ 2 moderator moderator ... moderator  # no changes needed
drwxrwx--- 2 root      shared    ... shared     # needs setgid permission
drwx------ 2 user1     user1     ... user1      # no changes needed
drwx------ 2 user2     user2     ... user2      # no changes needed

So, assuming your users' default umask is set to 007 or 002 to allow full access to the group, you'll only need to give the shared directory the setgid bit. This will cause all new files created in this directory to be automatically assigned to the group that owns the directory.

You can do it in two ways:

chmod g+s shared

or

chmod 2770 shared   # 2770 = permissions drwxrws---

However, if your users' default umask is 022 or 077 (disallowing group write access), you might also need to add a default ACL to the directory:

setfacl -m d:g:shared:rwX shared

After this, the permissions of the shared directory will be displayed as drwxrws---+, the plus sign indicating the presence of an Access Control List. You can view it with getfacl shared; the ACL will automatically be inherited by any sub-directories created, and it will ensure that the shared group will get full access to any new files or directories within.

One suggestion would be to:

• Create a non-privileged group to use as the primary group for all user accounts involved:

    # groupadd users

• Associate user1, user2 and moderator with this group. You may need to directly edit the password file:

    # usermod -g users user1
    # usermod -g users user2 ...

• Change the group of all the directories in the example to be 'owned' by this group:

    # chgrp -R users * # The current working directory should be the base dir for all the
                       # directories in your example

• Set the 'restricted deletion' and the 'setgid' bits on the 'shared' directory and allow user and group for read, write and execute:

    # chmod 3775 shared

All of the above will give all users that belong to the 'users' group, the possibility of writing files in the shared directory without being able to remove files they did not create. An alternative option would be to use a secondary group and have the users change their session group whenever they want to write in the 'shared' directory. I hope this helps, YMMV, standard disclaimers apply :)

The permission +x is the most secure. Your try to limit the permisions for root, think about this: d---rwx--- : in this case, become with d for it is a directory, if it is empty is a file. Them, you have three sections of three space rwx ¿what is it? read write and execute. The first block is for root (root privilegies is the most warm) second block is for users and the final block por groups. You can edit each of block with rwx permissions. When it is a blank space, there aren't a permission. Your solution for me maybe is try to create a group with user 1 and user 2 called group twice, and them you asign privilegies of read and execute, only in that group. ¿Do you know how make it? Try with the information before, or ask other question, thanks.