Shared Design Folder, Umask, and a Read-Only Contractor

Mina can create files because the directory is group-writable (2775), but the files themselves are created with mode 644: the process umask 022 strips group write. Group ownership is correct thanks to the setgid bit on /srv/design (the leading 2), which makes new entries inherit the design group, but setgid does not grant permissions. Fix the default for designers by setting umask 002 in a profile file that only the design team reads, or more robustly use a default ACL. For existing content: find /srv/design -type d -exec chmod 2775 {} + and find /srv/design -type f -exec chmod 664 {} +. Applying chmod -R g+rw alone can add execute to files and remove the setgid bit if you are careless; the find split preserves directory setgid and avoids making files executable. Verify with ls -ld /srv/design, ls -l on a sample, and getfacl. A default ACL such as setfacl -d -m g:design:rwx /srv/design makes new files group-writable regardless of the creator's umask, but the ACL mask must allow it; check getfacl for mask::rwx. Avoid 777: it gives every local account write access and lets a compromised process alter designs.

Adding Raj to design is the wrong tool: group membership is global to the host, persists after two weeks unless someone remembers to remove it, and grants whatever the group can do elsewhere, including write. A bind mount or a second copy is heavier and can drift out of sync; a copy also duplicates possibly licensed artwork. POSIX ACLs are the right fit. Apply a recursive read-only ACL: setfacl -R -m u:raj:rX /srv/design. rX means read on files and execute/traverse only on directories, so Raj can list and open files but cannot create, modify, or delete. Add a default ACL so new files are covered: setfacl -d -m u:raj:rX /srv/design. Check getfacl /srv/design and a sample file; the mask:: entry must include r for Raj's effective permission to allow reads, and if files are mode 660 the mask may need adjustment. Do not give Raj the group. At the end of two weeks, remove with setfacl -R -x u:raj /srv/design and remove the default entry. Document the dates, and if Samba exports the share, confirm the share's own permissions do not override the ACL.

chmod -R 777 is simpler only in the sense that it removes the need to think. It gives every user and every process on the host write and execute permission on all design files and directories. A single compromised account, a malicious script, or a careless command can then alter or delete artwork, plant a replacement binary, or encrypt the share. It also defeats the group model and makes auditing impossible because 'who may write' becomes 'everyone.' The setgid bit can survive on directories, but file modes become 777 and any user can replace content. Use least privilege instead. Audit world-writable entries with find /srv/design -xdev -perm -0002 -ls; that includes files and directories, and -xdev avoids crossing into other filesystems. Find files not owned by the design group with find /srv/design -xdev ! -group design -ls. Check the sticky bit on shared scratch areas: ls -ld /tmp should show t, which prevents users deleting each other's files in a world-writable directory, but sticky does not make 777 safe for a design share. If you need a drop box, use a separate directory with write-only permissions or ACLs, not 777 on the main tree.