Shared Project Directory with Wrong Group Ownership
Five developers-alice, bob, carol, dave, and erin-share /srv/proj on a Linux server. The directory is owned by root:proj and was set to mode 2770 yesterday. Each user's primary group is their own username; all five are supplementary members of proj. New files created by alice still show group alice, not proj, and bob cannot edit them. The admin added umask 002 to /etc/profile, but the problem persists for files created in /srv/proj/subdir, which was created before the setgid change. The team also needs a repeatable way to delete .tmp files older than 90 days and to list files changed in the last 7 days. A contractor, contractor, needs read-only access to the whole tree without being added to proj.
1. Why do new files still get group `alice`? Explain the setgid bit and what to check and fix recursively.
Read the worked answer
Setgid on a directory makes new files inherit the directory's group only when the directory itself has the setgid bit and its group is proj. It does not change existing files or files created in subdirectories that lack setgid. /srv/proj may be drwxrws---, but /srv/proj/subdir was created before the change and likely has group root or alice without setgid, so files inside inherit that group. umask 002 only controls permission bits (it enables group write); it does not set group ownership. Also, /etc/profile applies to login shells, not necessarily to all processes.
Check:
ls -ld /srv/proj /srv/proj/subdir
find /srv/proj -type d ! -perm -g+s -ls
Fix recursively:
sudo chgrp -R proj /srv/proj
sudo find /srv/proj -type d -exec chmod g+s {} +
Then verify with ls -ld and create a test file.
2. Write the `find` commands to list files modified in the last 7 days and to remove `.tmp` files older than 90 days. What safety checks would you add?
Read the worked answer
List recent files:
find /srv/proj -type f -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM %p\n'
Preview old .tmp files:
find /srv/proj -type f -name '*.tmp' -mtime +90 -print
Delete after review:
find /srv/proj -type f -name '*.tmp' -mtime +90 -delete
Safety: run the -print version first; consider -maxdepth if you do not want recursion; -mtime +90 means older than 90 24-hour periods, so files at exactly 90 days may be included depending on rounding. Use -daystart if you need calendar-day semantics. Avoid rm -rf with unquoted variables; -delete is safer because it only deletes matched files.
3. How would you give `contractor` read-only access to the whole tree using ACLs, and how do you ensure new files inherit that access?
Read the worked answer
Grant read-only ACL to existing tree:
sudo setfacl -R -m u:contractor:rX /srv/proj
X gives execute only on directories and on files that already have execute for some user, so the contractor can traverse directories but not execute ordinary files. For new files/dirs, set a default ACL on each directory:
sudo setfacl -R -d -m u:contractor:rX /srv/proj
Check with getfacl -R /srv/proj | less. The ACL mask must allow read and execute; setfacl usually recalculates it. If the contractor cannot traverse, check getfacl on each directory. This is more granular than adding the contractor to proj, which would give write access.