4

I was wondering about the following behavior:

I have three users A, B and C. A creates a folder and changes the group ownership to C's group.

mkdir fold chgrp C fold chmod g+rw fold

Now I add B to the C user group by

usermod -a -G C B

and id B gives me uid=1002(B) gid=1002(B) groups=1002(B),1003(C). Trying to change the content of fold (mkdir fold/fold2 or touch fold/test) as user B, however, gives me a permission denied and only A and C can change the contents of that folder. What is the reason? If I change the gid of B to C by usermod -g C B, but this can't be the proper way right?

Improve this question
2

1 Answer 1

Reset to default
4

Accessing a directory requires the execute (x) permission. The read (r) permission only lets you list the directory's contents, not access that content. The write (w) permission is useless without x.

chmod g+x fold

(For the benefit of future visitors with similar, but not identical symptoms)

In the output of id, gid is the user's primary group and groups lists all the supplementary groups as well. The primary group is the one listed in the passwd file and the supplementary groups are the ones listed in the group file.

The membership of a user in a group is only meaningful to the login system. After login, there is no relationship between users and groups. Each process, starting with the login process, has a primary user¹, a primary group, and any number of supplementary groups. Thus a change of the user and group databases only takes effect in sessions started after the change. In a nutshell: after adding a user to a group, log out and back in.

¹ Two, actually: effective and real — but I won't go into that here as it only applied to setuid/setgid programs.

Improve this answer
3
  • 1
    No, w on a directory means permission to change the directory, i.e., add/delete/rename file names in it. You'd need x to access the contents (files) in the directory, which is quite different. Commented Jan 30, 2014 at 13:49
  • 1
    Today, a process can belong to many groups simultaneously. And that "today" is older than Linux, IIRC. Commented Jan 30, 2014 at 13:51
  • @vonbrand Yes, all these groups are supplementary groups. The principal group is relevant for a few things, such as which group a newly-created file belongs to under SysV semantics. Commented Jan 30, 2014 at 15:45

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.