0

I'm trying to use set default permissions for directories and files but not having much joy. What I am trying to share a specific directory on a local external drive connected to the server internally. Everyone in the group has access to the drive and can view all the files.

However once a new file is created by mac08, the group permissions are not set and only that user has access to modify it.

Here is an example of two txt files. The one created by mac08 has 644 permissions and all other users like mac07 etc. can't write to the file.

I have a group called staff and have added everyone to it, but new files created don't follow.

drwxrwxrwx+ 159 root  wheel  5406 22 Aug 11:08 PROJECTS
 0: group:Staff allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity

New file created:

-rw-rw-rw-@ 1 root   wheel     351 22 Aug 23:17 test4.rtf
 0: group:Staff allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity
 1: user:aserver allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity
 2: user:ckadmin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity

-rw-r--r--@ 1 mac08  wheel     352 22 Aug 23:26 testet11.rtf
 0: group:Staff allow read,write,append,readattr,writeattr,readextattr,writeextattr

I can manually update the permissions through the Get Info window but this requires me to reset permissions every time a person saves a new file to the drive. Any idea what it could be?

  • Who created the file test4.rtf? – klanomath Aug 23 '16 at 0:24
  • I did but then manually reset the permissions so that Group could have access. – namit Aug 23 '16 at 8:16
  • You did this with your root user? Or has the root user ownership been propagated to subsequent files by updating the permissions in the get info window? – klanomath Aug 23 '16 at 8:22
  • Yes if I use get info and reset permissions from the root folder Project it does propagate to all folders. But without that if I create new folder or file it only sets permissions for RWX for user who created it. – namit Aug 23 '16 at 9:14
2

To create a properly working Projects share do the following:

On your external disk create a folder "Projects". Share this Projects with default permissions in Server.app > File Sharing. The default permissions are 755, the default owner is the user who created the folder and his primary group (e.g. adminuser:admin):

drwxr-xr-x+   6 adminuser  admin  -       204 Aug 23 10:54 Projects
 0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit

In this folder create another folder with the name Projects. Change the permissions to 770 and the group to staff:

mkdir Projects
chown adminuser:staff Projects
chmod 770 Projects

The permissions now look like this:

drwxrwx---+   6 adminuser  staff  -       204 Aug 23 10:54 Projects
 0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit

Then add an ACL for the group staff:

chmod +a "group:staff allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" Projects

with the result:

drwxrwx---+ 2 adminuser  staff  -   68 Aug 23 11:09 Projects
 0: group:staff allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit
 1: user:_spotlight inherited allow list,search,file_inherit,directory_inherit

The complete path to the Projects folder (containing a test folder and a test.txt file - Data is the name of my volume on the external disk) is then:

/Volumes/Data/Projects/Projects:
total 0
drwxrwx---+ 4 adminuser  staff  - 136 Aug 23 11:24 . #this is /Volumes/Data/Projects/Projects
 0: group:staff allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit
 1: user:_spotlight inherited allow list,search,file_inherit,directory_inherit
drwxr-xr-x+ 6 adminuser  admin  - 204 Aug 23 11:09 .. #this is /Volumes/Data/Projects
 0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit
drwxr-xr-x+ 2 adminuser  staff  -  68 Aug 23 11:24 test
 0: group:staff inherited allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit
 1: user:_spotlight inherited allow list,search,file_inherit,directory_inherit
-rw-r--r--+ 1 adminuser  staff  -   0 Aug 23 11:24 test.txt
 0: group:staff inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity
 1: user:_spotlight inherited allow read,execute

Now any subsequent file and folder of /Volumes/Data/Projects/Projects can be modified by any user in the group staff. You may tweak/tighten some of the permissions by not adding them (e.g. readextattr and writeextattr)

  • Great looks to be working thanks, now how come that can not be done thought UI? appreciate he help. – namit Aug 23 '16 at 21:04
  • @namit It can be done partially with the get info window by adding a 4th entry (e.g. a new group or user). It's not as fine-grained though. Else: propedit – klanomath Aug 23 '16 at 21:08
  • Thanks appreciate your help banging head off wall why this kept resetting and hit and miss on users. – namit Aug 23 '16 at 21:10
  • @namit This is standard UNIX behavior. You may change umask though - which is not recoommended. Standard umask is 022. If you change it to 002 you will get a similar behavior as with the provided chmod +a command. The linked app (somehow abandoned-ware) works at least with 10.9. – klanomath Aug 23 '16 at 21:16
  • @namit If the linked app (PropEdit works) in your system, you can legally use the following key to register it: 0GYF-CMX2-49X3-B1VH-8CA9 – klanomath Aug 23 '16 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .