Task Details
Implement a shared "simboard" directory, and unix group, representing a common location for simboard repository and work directory that can persist across personnel changes. The group has no special privileges, and once the group is established, sys admins (root) are only needed to add or remove this group membership designation to selected accounts. Files within can be made group-writable or executable without being more generally accessible to non-member manipulation.
Steps to Complete
Obtain sys admin cooperation in establishing the unix group "simboard"
Have an admin add this group to selected user accounts, making them members.
Thereafter, any member can "chgrp simboard"[*] a file or directory to make it accessible while restricted to only other simboard members.. For instance, we expect to make a directory /lcrc/group/e3sm2/simboard that will be "simboard" readable, writeable and executable, as a stable location of simboard operations.
[*] may not always be true. See Additional Notes.
Additional Notes
I asked LivChat:
If (user-level) chgrp is not available, and a user belongs to several groups, a file they create will gain only their primary group ownership. To force the more restricted "simboard" group ownership, what steps must be taken that would not incur a (root) sys-admin be continually involved?
The Response:
Use a setgid directory owned by simboard. Then files and directories created within it inherit simboard as their group, regardless of the creator’s primary group.
sudo mkdir -p /path/to/simboard
sudo chown root:simboard /path/to/simboard
sudo chmod 2770 /path/to/simboard
The 2 in 2770 enables the setgid bit. Add users once:
sudo usermod -aG simboard alice
sudo usermod -aG simboard bob
After users start a new login session, files created there inherit the group:
/path/to/simboard/file group: simboard
For consistent group-readable and group-writable permissions, configure default ACLs if supported:
sudo setfacl -m g:simboard:rwx /path/to/simboard
sudo setfacl -d -m g:simboard:rwx /path/to/simboard
Users must also ensure their umask does not remove the desired group permissions. A setgid directory is normally sufficient, and no continuing administrator involvement is required.
The important point, "no continuing administrator involvement is required."
Task Details
Implement a shared "simboard" directory, and unix group, representing a common location for simboard repository and work directory that can persist across personnel changes. The group has no special privileges, and once the group is established, sys admins (root) are only needed to add or remove this group membership designation to selected accounts. Files within can be made group-writable or executable without being more generally accessible to non-member manipulation.
Steps to Complete
Obtain sys admin cooperation in establishing the unix group "simboard"
Have an admin add this group to selected user accounts, making them members.
Thereafter, any member can "chgrp simboard"[*] a file or directory to make it accessible while restricted to only other simboard members.. For instance, we expect to make a directory
/lcrc/group/e3sm2/simboardthat will be "simboard" readable, writeable and executable, as a stable location of simboard operations.[*] may not always be true. See Additional Notes.
Additional Notes
I asked LivChat:
The Response:
The important point, "no continuing administrator involvement is required."