Subject: [netatalk-admins] the big step...

From: Rick Zeman <[email-masked]>
Date: Sun, 21 Mar 1999 01:16:11 -0500

I'm about ready to take the plunge and dedicate a filesystem for Mac 
access.  As I'm set up now, each user can mount his/her own home 
directory.

What would be the best to set up /mac so each user can read everything, 
but only write/delete what they've created.  Easy to do it netware, 
but....

---

From: Eddie Irvine <[email-masked]>
Date: Mon, 22 Mar 1999 00:17:58 +1000

Hi, Rick.

I think you need to look at setting the "sticky bit" on any
"global" directory - that is, any directory that is mounted
by everyone - I assume you mean a directory called "/mac".
man chmod.

But, if users are just mounting their "home" directory,
(and every user has their own user name and 
home directory - the usual unix way of doing things,)
unless I've missed something over the last three years
what you want is really the default.

---

From: Brad Cox <[email-masked]>
Date: Sun, 21 Mar 1999 08:46:02 -0500

> but only write/delete what they've created.  Easy to do it netware,

Be sure they don'e create aliases on these volumnes. This will crash 
atfp in minutes. asun's working on it. (symbolic links work tho).
---
Dr. Brad Cox [email-masked] (update your address book)
Phone: 703 361 4751 Fax: 703 995 0422 Cellular: 703 919-9623
http://virtualschool.edu/mon A Project with Paradoxical Goals
PGP Signature: E194 C6E5 92D8 B8FB 20E8  8667 929A 95A0 FCB6 7C62

---

From: PayPC System Mail Subscriber <[email-masked]>
Date: Mon, 22 Mar 1999 14:45:32 +1000

Rick Zeman said in [netatalk-admins] the big step... at 21/Mar/1999 (Sun) 
16:16:11.

> but only write/delete what they've created.  Easy to do it netware, 

Make a new group, say, macusers, and add all of the users that need shareable 
access to that group.

chown --recursive admin:macusers /mac
chmod 2770 /mac

This should make a "sticky" bit for GID permissions, and such.  So that all 
created objects inherit the "macusers" group. [Someone correct me if I'm 
wrong, please].

Then.... you should create the "Network Trash Folder"

make it owned by the admin, and og+rx only.

Then, for each user, make a Trash Can #n (where n is an ascending integer)
owned by them, mode 0700.

If you had many users, I'd write a small script that looked at a specified 
group, and did all of this nonsense for you.  It wouldn't be terribly 
difficult to write.

For instance, my Trashcan folder looks like this:

drwx------   8 bugs     root         1024 Mar 17 08:46 Trash\ Can\ #1/
drwx------   3 daffy    root         1024 Mar 15 16:53 Trash\ Can\ #2/
drwx------   2 tweety   root         2048 Mar 17 19:58 Trash\ Can\ #3/
drwx------   2 foghorn  root         1024 Mar  4 16:14 Trash\ Can\ #4/
-rwxrwxrwx   1 root     root            0 Aug 20  1998 Trash\ Can\ Usage\ Map

[This will allow each user to have their own "trash can" without other users 
being able to sniff through them... it will also allow trash can 
functionality.  This is one of the known work-arounds for Network Trash 
functionality - the others require source patches.  Adrian: if you've fixed 
this with the byte-locking functionality you've added recently, let us 
know...  ]

Voila!  You should be all set.

One of these days, I'll add "samba-like" share-level controls over the 
ownerships of created directories, files, and allowed users, etc.

=Rob=

---

From: Palle Girgensohn <[email-masked]>
Date: Mon, 22 Mar 1999 13:38:50 +0100

PayPC System Mail Subscriber wrote:
...
> ownerships of created directories, files, and allowed users, etc.

I'm looking forward to that! It would help a lot.

/Palle

---

From: Anthony Brock <[email-masked]>
Date: Mon, 22 Mar 1999 16:09:36 -0800

>I'm looking forward to that! It would help a lot.

Just curious, but are there any solutions for adding NT like permissions to
the directories?  What I mean is, is it possible to have a directory owned
or accessible by more than one group and/or user?  Or even better, is it
possible to make groups of groups?

This is probably the most frustrating limitation I have found in
Netatalk/Samba so far, and seems to only be solved if I use an NT domain
controller with Samba.  However, I know of no solutions for Netatalk or
Unix.

Just curious, :)

Tony

============================================================================
Anthony W. Brock                                Director of Network Services
[email-masked]                                  George Fox Univerisity
----------------------------------------------------------------------------

---

From: Jim Zajkowski <[email-masked]>
Date: Mon, 22 Mar 1999 22:46:59 -0500 (EST)

On Mon, 22 Mar 1999, Anthony Brock wrote:

} This is probably the most frustrating limitation I have found in
} Netatalk/Samba so far, and seems to only be solved if I use an NT domain
} controller with Samba.  However, I know of no solutions for Netatalk or
} Unix.

The Andrew File System (AFS) can do ACALs, but that's probably way
overkill for what you need.

Rumor has it a new Linux FS will support it (ext3?)

Jim