You need to understand how Unix DAC (Discrete Access Control) security is working in a HFS (Hierarchical Files system). The other one is the role the "Owner" has in that Unix security concept and I would not bother too much on ACL's Jerks and confinement (SElinux) no having those. The remarks: - ACL's looks more convenient as the similarity to Windows. They are unreliable as the access check can disappear unexpected. the goals is a fixes not changing environment. - Jerks is the idea you can limit access rights by granting them to additional groups - Selinux is delivering the containerization you can find with Docker (and SAS-VA). The maximum numbers of groups on a Linux/Unix system was once a problem (Posix-8 BSD-16). Windows for a long time far better with 1020. Check that number with ngroups_max limits.h https://www.j3e.de/ngroups.html As modern systems are above that old low limit that should be no problem anymore. One exception is the NFS system. Some nice papers on DAC are: part 1 Hacking Linux Exposed part 2 Hacking Linux Exposed For a sharing and isolation strategy you need to design your hierarchy What must be able to be shared should be in the same hierarchy, what should be isolated must be in separated trees. The idea is starting a full read/execute access (directories) and than limiting the directories in still further refinements. The reason: all access of the complete hierarchy every level counts and cannot be bypassed. This is needing to switch your mind as the initiation is only seeing the current directory (wrong!). The owner of directories/folders is for the best done with a privileged key (functional account) or you will sooner or later running get into problems. I don not see the setting the owner-group? For the DAC rights owner/group/other only one of the tree will evaluated, not all. For changing to a directory you need a Execute grant for that directory For moving/deleting files you need write access to the directory. No, no grants on the file itself as it is only a registration in the directory. (Often being faulty interpreted). To have only the owner of the directory or the owner of the directory doing a delete/move you need to set the sticky bit on the directory. The bad thing is, you will see a differentiation in DAC rights of files and directories. It is how -Nix systems DAC are working. Having files being created by users, the primary group of the user will be set to the file. That is not necessary the same as the group of the directory. To have the files the same group as the directory set the groupid on the directory. There is no need the user processing a file in that directory is a member of that group. Your elegant approach request looks like wanting to have a file dropping zone. Create a dedicated directory as a marketing dropping zone eg: .../drpbx/marketing Set the group to marketing , Set the DAC rights as 3777 (sticky bit and groupid bit) - Anybody having access to drpbx can post files in that marketing directory (you can limit the usage by using a dedicated group on drpx) - The files will be able to be accessed by the marketing group and the owner of the file. The owner of the file will have to set those rights - the "owner" of the directory marketing can delete files when dacs (chmod) for the user/group are wrong.
... View more
