Shared research directory loses group write access
A five-person research team (mira, jo, sam, lee, ana) shares /srv/trialdata on a Debian 12 server. The directory is owned root:trials, mode 2775. /etc/group lists all five in trials. mira creates /srv/trialdata/run-042.csv; ls -l shows -rw-r--r-- 1 mira trials. jo cannot append to it. In mira's SSH session, id shows groups mira and sudo but not trials, although getent group trials lists her. ana copies /home/ana/template.csv into /srv/trialdata with cp; the result is mode 0644. /etc/login.defs sets UMASK 022, and no pam_umask or profile.d umask override exists. The group needs new and copied files to be group-writable and group-owned by trials, while remaining non-world-readable because the CSVs contain patient data. A contractor, kai, needs read-only access to /srv/trialdata/run-042 only, without joining trials. Changes must survive new logins and must not require a reboot.
1. Explain why jo cannot write despite the 2775 directory mode, and why mira's id lacks trials. What immediate commands let mira write in her current shell, and what permanent check would you perform for all users?
Read the worked answer
The 2775 mode gives the trials group write permission on the directory, so jo can create or unlink entries. It does not grant write on a file that mira created; that file's mode is 0644, and its group is trials only because the directory has setgid. umask 022 stripped group write at creation. Separately, mira's id does not show trials because supplementary groups are assigned at login; adding her to /etc/group does not update an existing shell's credentials. Confirm with getent group trials, id, and stat -c '%a %U %G' /srv/trialdata/run-042.csv. For an immediate fix in mira's current shell, use newgrp trials (starts a new shell with the group as primary) or sg trials -c 'command'; a fresh SSH login also picks it up. Permanent check: sudo -u mira id and sudo -u jo id after a new session, plus groups in each session. jo still needs the file mode fixed: chmod g+w /srv/trialdata/run-042.csv.
2. Design the directory permissions and default ACLs so files created by any trials member are 0660 and group trials, copies from /home are also 0660, and no other user can read them. Give commands and explain why umask alone is insufficient.
Read the worked answer
Make the directory group-owned, setgid, and non-world-accessible, then add a default ACL so inheritance does not depend on each user's umask:
sudo chgrp trials /srv/trialdata
sudo chmod 2770 /srv/trialdata
sudo setfacl -m g:trials:rwx /srv/trialdata
sudo setfacl -d -m u::rwx,g::rwx,o::---,m::rwx /srv/trialdata
The 2 keeps the group trials on new entries; 2770 removes all access for others; the default ACL supplies rwx inheritance for the group and no permissions for others on new files and subdirectories, while the create mode still strips execute from regular files. Umask alone is insufficient because it is per-process and per-login: a user with 022, a sudo command, or a service can still create a 0644 file, and the directory cannot force group write just with mode bits. Do not rely on cp honoring the default ACL blindly: test sudo -u ana cp /home/ana/template.csv /srv/trialdata/ and check getfacl. If the result lacks group write, provide a wrapper such as install -m 0660 or a cp function that runs chmod g+rw after copying into /srv/trialdata; the test is the acceptance criterion. Also set umask 007 in /etc/profile.d/trials.sh for interactive shells as defense in depth.
3. How do you give kai read-only access to that one CSV without exposing the rest of the directory, and what exact checks prove the restriction works?
Read the worked answer
kai needs execute (search) permission on every directory component from / to the file, read on the file, and no read on the directory listing. Because /srv/trialdata is 2770 and kai is not in trials, grant only traverse on the shared directory, then read on that one file:
sudo setfacl -m u:kai:x /srv/trialdata
sudo setfacl -m u:kai:r-- /srv/trialdata/run-042.csv
Do not add r on /srv/trialdata: that would let kai list every patient-data filename. Do not add kai to trials: that grants write to every group-writable file and directory. Verify with namei -l /srv/trialdata/run-042.csv, getfacl, and sudo -u kai cat /srv/trialdata/run-042.csv plus sudo -u kai ls /srv/trialdata (the latter should fail). If the parent /srv is not world-executable, add u:kai:x there too. The ACL mask must allow read; setfacl recalculates it, so check getfacl for mask::r--. This is least privilege for one file; a new file would need its own ACL unless you add a default entry for kai under a dedicated subdirectory.