1

I am working in my Tomcat deployment directory. The files in the directory have the permission: 

drwxrwsr-x. 10 tomcat www 4.0K Mar 15 15:14 webapps

A sample sub-directory within webapps looks like this: 

drwxr-sr-x. 6 tomcat www 4.0K Mar 15 15:19 oldApps

While I am a member of group www, I am able to create directories in oldApps. This is despite the group www having no write permissions on oldApps.

I have a line in my sudoers file that allows mkdir to members of www group. I am not able to understand how I can write to the folder oldApps without any write permissions on the folder.

Update:
Ok, I get that I might be running the mkdir command as root, thus allowing me to create folders. How do I remove the line from sudoers and still be able to create directories?

Improve this question

2 Answers 2

Reset to default
0

You actually answered your own question: The reason you can create a subdirectory where your group has no write permissions, is because you have a line in your sudoers file that allows mkdir to members of your group.

Perhaps you are confused about the purpose of the sudoers file and the sudo command: You don't need to explicitly allow every command that you intend for someone to run; in fact you shouldn't do this.

sudo is for running privileged commands. You should only give someone sudo access for commands that you wish them to be able to run as root. With full sudo access for any command, the user can do anything, regardless of the permissions settings of individual files and directories.

Improve this answer
5
  • Agreed. I figured I was running the mkdir command as root. How do I get the ability to run mkdir on www if I did not have the entry in the sudoers file Commented Mar 15, 2016 at 10:15
  • @Sriram, chmod g+x oldApps, you mean? Not sure I get the question. Commented Mar 15, 2016 at 10:37
  • I meant if I remove the entry in the sudoers file, I cannot create the directory. How do I remove the sudoers entry and still create the sub-directory? Commented Mar 15, 2016 at 10:55
  • @Sriram, the most straightforward way would be to give your group write permissions on that directory, unless you have some reason not to. chmod g+w oldApps (my last comment had a typo, sorry.) Commented Mar 15, 2016 at 11:03
  • This did not work. I am not able to delete any sub-directory of oldApps - with sudo or without. Commented Mar 15, 2016 at 12:01
0

The reason that you can create the directory is due to the fact you are using sudo. The actual mkdir command runs (most probably) as tomcat. Since the set-gid attribute is set the group on the new directory is still www

Update:

To add permissions to another user and/or group you can use extended ACLs:

setfacl -d -m g:www:rwx oldApps setfacl -m g:www:rwx oldApps
Improve this answer
6
  • Thanks for your reply. I have updated the question. I realize that making changes to sudoers is not ideal. How do I create a directory without a line in sudoers? Commented Mar 15, 2016 at 10:17
  • You might use extended ACLs, see updated answer. Commented Mar 15, 2016 at 10:23
  • I tried both commands as you suggested, but the I am still unable to delete any files/folders within oldApps. Commented Mar 15, 2016 at 12:03
  • For existing directories you may need to set the extended ACLs recursively. See man setfacl and search for 'recursive' Commented Mar 15, 2016 at 12:08
  • The /etc/fstab entry does not have an acl in the options taken while mounting. Could that also be a reason why this is not mounting correctly? Do I need to remount with acl options set? Commented Mar 15, 2016 at 13:03

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.