For this type of granularity you'll want to use ACLs. With ALCs you can assign different permissions to multiple users or groups. To accomplish what you're asking you would run the following commands (assuming your directory is called dir):
setfacl -m u:user1:rwx dirsetfacl -m u:user2:rwx dirsetfacl -m u:user3:- dirsetfacl -m u:user4:- dirsetfacl -m u:user5:rx dirsetfacl -m u:user6:rx dir
This will give full access to user1 and 2, no access to user3 and 4, and read/execute permissions to user5 and 6. If you do a ls -ld
on the directory you will notice it now has a +
appended to the permission bits.
$ ls -ld dirdrwxrwxr-x+ 2 user0 users 40 Dec 7 11:42 dir
The +
means it has one or more ACLs associated with it. You can see the ACLs with the getfacl
command:
$ getfacl dir# file: dir# owner: user0# group: usersuser::rwxuser:user1:rwxuser:user2:rwxuser:user3:---user:user4:---user:user5:r-xuser:user6:r-xgroup::r-xmask::rwxother::r-x
Also worth noticing is that the ls
command seems to show that the directory is group writable, but the getfacl
command shows that it's not. The ACL is correct here, meaning if a user in the users
group, but not otherwise named in the ACL or the file ownership tries to create a file in the directory, it will fail.