Give user permission to folder in home directory

filesgrouppermissions

I have just installed resilio sync and have it running fine. It creates a user 'rslsync' by default. I want to have the default folder that houses all of my sync items in my home directory which currently rslsync has no access to of course.

I have created a directory in my home directory called 'sync'. In the sync directory I have also created 2 folders 'dropbox' and 'resilio'. I would like the folder 'resilio' to be the default location for my files that resilio running as the 'rslsync' uses.

What is the best way to give user 'rslsync' read, write and execute access to the 'resilio' folder located in my home directory? Would simply adding user 'rslsync' to my user group give it all the access it needs?

Best Answer

A program can access a file if any of the following is true for that file as well as any directories that need to be traversed:

  • the user that the program is running as has access;
  • any of the groups that the program is running as has access;
  • everybody has access.

(This is actually not true in all cases but it's a good enough approximation here.)

Note that which users are members of which groups does not come up. This information is only used when a user logs in: it causes the programs in that login session to run as those groups. Thus adding a user to a group cannot solve your problem.

You need to give the user rslsync access to the resilio directory as well as the whole directory chain leading there. To access /home/liam/sync/resilio, the program needs the directory traversal permission (x attribute, which means “execute” for regular files) on /, /home, /home/liam, /home/liam/sync and /home/liam/sync/resilio, as well as the read permission on /home/liam/sync/resilio.

You can do that with an access control list:

setfacl -m u:rslsync:x /home/liam /home/liam/sync
setfacl -R -m u:rslsync:rx /home/liam/sync/resilio
setfacl -R -d -m u:rslsync:rx /home/liam/sync/resilio

The first line ensures that rslsync can traverse the leading directories. The second line gives rslsync access to the whole directory tree rooted at /home/liam/sync/resilio. The third line with the -d flag sets the default ACL for newly created files — without this, rslsync would not be able to read any newly created file.

Some applications may create files with a more restrictive ACL than the default ACL. This can especially happen when files are copied from another location. In this case rslsync wouldn't be able to read those files. There's a different approach that ensures that rslsync can always read the files, which is to create an alternative view of the tree at /home/liam/sync/resilio with different permissions. You can do that with bindfs. Note that you have to do the mounting as root to allow another user to access a bindfs filesystem. You can use the following line in /etc/fstab:

bindfs#/home/liam/sync/resilio /var/lib/rslsync/resilio fuse ro,force-user=rslsync,perms=u+rD:go=
Related Question