UPGs make it safe to set default permissions for a newly created file or directory which allow
both the user and that user's group to make modifications to the file or directory.
The setting which determines what permissions are applied to a newly created file or directory is
called a umask and is configured in the
/etc/bashrc
file. Traditionally on UNIX systems, the
umask
is set to
022
, which allows only the user who created the file or directory to make
modifications. Under this scheme, all other users, including members of the creator's group, are
not allowed to make any modifications. However, under the UPG scheme, this "group
protection" is not necessary since every user has their own private group.
4.1. Group Directories
Many IT organizations like to create a group for each major project and then assign people to
the group if they need to access that project's files. Using this traditional scheme, managing files
has been difficult; when someone creates a file, it is associated with the primary group to which
they belong. When a single person works on multiple projects, it is difficult to associate the right
files with the right group. Using the UPG scheme, however, groups are automatically assigned
to files created within a directory with the setgid bit set. The setgid bit makes managing group
projects that share a common directory very simple because any files a user creates within the
directory are owned by the group which owns the directory.
Lets say, for example, that a group of people work on files in the
/usr/lib/emacs/site-lisp/
directory. Some people are trusted to modify the directory, but certainly not everyone is trusted.
First create an
emacs
group, as in the following command:
/usr/sbin/groupadd emacs
To associate the contents of the directory with the
emacs
group, type:
chown -R root.emacs /usr/lib/emacs/site-lisp
Now, it is possible to add the proper users to the group with the
gpasswd
command:
/usr/bin/gpasswd -a <username> emacs
To allow users to create files within the directory, use the following command:
chmod 775 /usr/lib/emacs/site-lisp
When a user creates a new file, it is assigned the group of the user's default private group.
Next, set the setgid bit, which assigns everything created in the directory the same group
permission as the directory itself (
emacs
). Use the following command:
chmod 2775 /usr/lib/emacs/site-lisp
Chapter 6. Users and Groups
94
Summary of Contents for ENTERPRISE LINUX 4.5.0 -
Page 1: ...Red Hat Enterprise Linux 4 5 0 4 5 0 Reference Guide ISBN N A Publication date ...
Page 2: ...Red Hat Enterprise Linux 4 5 0 ...
Page 4: ...Red Hat Enterprise Linux 4 5 0 ...
Page 24: ...xxiv ...
Page 26: ......
Page 36: ...12 ...
Page 72: ...48 ...
Page 112: ...88 ...
Page 122: ...98 ...
Page 140: ...116 ...
Page 142: ......
Page 300: ...276 ...
Page 318: ...294 ...
Page 320: ......
Page 332: ...308 ...
Page 350: ...326 ...
Page 378: ...354 ...
Page 388: ...364 ...
Page 394: ...370 ...
Page 395: ...Part IV Appendixes ...
Page 396: ......
