Subject: [netatalk-admins] Problems grasping permissions with Netatalk

From: [email-masked]
Date: Mon, 17 Aug 1998 20:20:11 +1200

<wham, wham, wham>

OK, I have a problem with netatalk, which I suspect (and hope) is a
conceptual problem, rather than a problem with netatalk itself.

To give an overview:

I have a Linux system with an asun patched netatalk 1.4b2.  I am setting it
up to allow electronic ad delivery, over an IP network, with FTP, afp/ip,
and (eventually) smb/ip.

In order to give our clients sandboxes of their own, I set up a
/home/clients/clientname structure.  Our production staff have a seperate
login which has .AppleVolumes set to look at /home/clients.

So far, so good.  I have a tree that looks like:

/home---clients---foo
		|-bar

/home/clients is uid root, gid production, with drwxrwx--- perms.

/home/clients/foo is uid foo, gid foo, with drwxdrwx--- perms.

The production uid is a member of the foo and bar groups.

So far, so good.  The client can control files, no problems, in his
directory.  The production login allows folders to be manipulated, and
ditto work inside folders.

*But* production can't copy files into the /home/clients/foo directory, or
trash them.  On the mac side, I get a generic "You don't have permission"
error; on the Linux side, I see:

Aug 17 19:48:23 ftp afpd[2982]: setfilparams: ad_open Month_end: Permission
denied
Aug 17 19:48:45 ftp afpd[2982]: setfilparams: ad_open Month_end: Permission
denied

in /var/log/messages.

Using FTP doesn't give this problem.

Initially, I couldn't create folders, but resolved that after looking at the
FAQ; I'm still stuck with the file creation.  				

-- 
Rodger Donaldson			[email-masked]
Systems Support				Direct line	: 04 474 0560
Wellington Newspapers Limited		Fax		: 04 474 0309
You are in a maze of twisty little companies, all working against each other.

---

From: Casey Bisson <[email-masked]>
Date: Mon, 17 Aug 1998 08:52:45 -0400

> error...

Check the perms on  the .AppleDouble .AppleDesktop and NetworkTrashFolder. They,
and everything inside them should be equal, or better to those on the enclosing
folder. At least, this has been my experience.

Casey Bisson
Information Technology
Plymouth State College

---

From: Jonathan Benson <[email-masked]>
Date: Tue, 18 Aug 1998 18:13:11 +1000

> FAQ; I'm still stuck with the file creation.

Try setting the suid on the group.

Eg.  chmod 2770 (from memory) or chmod g+s (for sure)

Then any folders/files created within that folder will inherit those permissions
(or something like that).   Sorry I'm not too clear on the matter as I'm about to
flee the office and can't be bothered delving in to my memory banks.  :)

I have 2 scripts I run for similar purposes and they MIGHT help you.  They are
run from the root of the directory tree to be shared.  I'm not sure if they are
current or reflect the current permissions on the directories, but...

This one is for a public directory which the group nobody can read/write to
and/or trash from.  This is shared via the /etc/atalk/AppleVolumes.system file.
Anyone who connects as a guest will be able to connect to it, as can those in the
group nobody.

chown nobody.nobody .
chown -R nobody.nobody * .??*
chmod -R g+w * .??*
cd "Network Trash Folder"
chmod g+rx .
chmod -R g+rx * .??*
cd ..
chmod 2770 `ls -Ra | grep / | sed s/:$// | sed s/" "/?/g | sed s/"'"/?/g | sed
s/"\""/?/g`

This one is for the production directories.  prod3 is just one of 4 users in the
production group.  These users (and one other) are also in the group nobody.
These directories are only seen to them by the use of an "AppleVolumes" file in
their home directories.  Eg. "/home/prod1/AppleVolumes"

chown prod3.production .
chown -R prod3.production * .??*
chmod -R g+w * .??*
cd "Network Trash Folder"
chmod g+rx .
chmod -R g+rx * .??*
cd ..
chmod 2770 `ls -Ra | grep / | sed s/:$// | sed s/" "/?/g | sed s/"'"/?/g`

I'm not sure, but the trash may be broken on the public share, but I think that's
a fault with netatalk and not my manipulation of the permissions.

Anyway, I hope that some of that makes sense.  :)

Jonathan

--
Jonathan Benson B.Eng. (Soft Sys Hon) <[email-masked]>
Systems Administrator, Phoenix Magazines, Phone: +61 3 9696 7200
http://www.phoenixmags.com.au