Red Hat Enterprise Linux uses a user private group
(UPG) scheme, which makes UNIX groups easier to
manage.
A UPG is created whenever a new user is added to the system. A UPG has
the same name as the user for which it was created and that user is the
only member of the UPG.
UPGs make it safe to set default permissions for a newly created file
or directory which allow both the user and that user's
group to make modifications to the file or directory.
The setting which determines what permissions are applied to a newly
created file or directory is called a umask and
is configured in the /etc/bashrc file.
Traditionally on UNIX systems, the umask is set to
022, which allows only the user who created the file
or directory to make modifications. Under this scheme, all other users,
including members of the creator's group, are not
allowed to make any modifications. However, under the UPG scheme, this
"group protection" is not necessary since every user has their own
private group.
Many IT organizations like to create a group for each major project
and then assign people to the group if they need to access that
project's files. Using this traditional scheme, managing files has
been difficult; when someone creates a file, it is associated
with the primary group to which they belong. When a single person
works on multiple projects, it is difficult to associate the right
files with the right group. Using the UPG scheme, however, groups are
automatically assigned to files created within a directory with the
setgid bit set. The setgid bit makes managing
group projects that share a common directory very simple because any
files a user creates within the directory are owned by the group which
owns the directory.
Lets say, for example, that a group of people work on files in the
/usr/lib/emacs/site-lisp/ directory. Some people
are trusted to modify the directory, but certainly not everyone is
trusted. First create an emacs group,
as in the following command:
To associate the contents of the directory with the
emacs group, type:
chown -R root.emacs /usr/lib/emacs/site-lisp |
Now, it is possible to add the proper users to the group with the
gpasswd command:
/usr/bin/gpasswd -a <username> emacs |
To allow users to create files within the directory, use the
following command:
chmod 775 /usr/lib/emacs/site-lisp |
When a user creates a new file, it is assigned the group of the user's
default private group. Next, set the setgid bit, which assigns
everything created in the directory the same group permission as the
directory itself (emacs). Use the
following command:
chmod 2775 /usr/lib/emacs/site-lisp |
At this point, because each user's default umask is 002, all members
of the emacs group can create and
edit files in the /usr/lib/emacs/site-lisp/
directory without the administrator having to change file permissions
every time users write new files.
