Subject: Permissions again...

From: Jason Quigley <[email-masked]>
Date: Fri, 09 Jun 2000 15:43:42 +0200

Hi!

I've got the following scenario:

addroup macuser
adduser --ingroup macuser jason
adduser --ingroup macuser macguest

/usr/sbin/afpd -n "$servername" -g macguest

ls -l
drwxrwxrwx   22 jason    macuser      1024 Jun  9 15:36 data

=> everyone can read/write/cd on this disc.

ls -l
drwxrwx--x   22 jason    macuser      1024 Jun  9 15:36 data

=> only creator (jason) can write to the disc. This doesn't make sense.

Can somebody tell me what I'm missing before I'm driven to distraction and
use the nearest heavy object to convince the server to do what I want?

Many thanks,
Jason.

---

From: Dejan Muhamedagic <[email-masked]>
Date: Fri, 9 Jun 2000 17:46:56 +0200

Hello,

> /usr/sbin/afpd -n "$servername" -g macguest

So far so good.

> => only creator (jason) can write to the disc. This doesn't make sense.

Not true.  User jason _and_ all members of group macuser can
read/write/cd to this directory.  The first triplet of permissions
is "user", the second "group" and the third "other".  When a
process is trying to access the file (or directory), it is first
checked if he (the process owner) is the owner of the file, and if
it is so, then the first triplet is used to grant/deny access.
If he's not the owner, it is checked if he belongs to a group
which owns the file, and if so, the middle triplet is used.
Otherwise, the last one is checked.

It is not clear what do you want.  Groups are created in order to
allow several users to have the same access (in respect to
read/write/cd,exec) to certain files/directories.  Whether what
you did makes sense I can't say.

> use the nearest heavy object to convince the server to do what I want?

Sure.  Just use plain English.

Best regards,

Dejan

---

From: Sak Wathanasin <[email-masked]>
Date: Fri, 9 Jun 2000 18:52:25 +0100

In reply to Jason Quigley's message of the 09/06/2000 at 15:43 +0200,

>use the nearest heavy object to convince the server to do what I want?

What you're missing are the permissions on hidden the directories 
.AppleDesktop and .AppleDouble. Presumably these have been created 
without group write perms.
-- 
Sak Wathanasin
Network Analysis Limited
178 Wainbody Ave South, Coventry CV3 6BX, UK

Internet: [email-masked]
Phone: (+44) 24 76 41 99 96        Mobile: (+44) 79 70 75 19 12 
Fax: (+44) 24 76 69 06 90

---

From: Robert Bell <[email-masked]>
Date: Fri, 09 Jun 2000 13:54:36 -0700

>.AppleDesktop and .AppleDouble. Presumably these have been created without 
>group write perms.

All directories used with netatalk should have set-groupid on
so that the .AppleDouble directories will have the same group id.

chmod g+s

or

chmod 2xxx

   Robert.