Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 97)

Chapter 6. Users and Groups 97

You can add a user to a group using redhat-conﬁg-users (see the Ofﬁcial Red Hat Linux Customiza-

tion Guide), or if you prefer to use the command line, use the /usr/sbin/groupadd groupname

command to create a group. The /usr/bin/gpasswd -a loginname groupname command will

add a user loginname to a group. (See the groupadd and gpasswd man pages if you need more

information on their options.) The /etc/group ﬁle contains the group information for your system.

If you created the devel group, added users to the devel group, changed the group for devel

directory to the devel group, and set the setgid bit for the devel directory, all devel users will be

able to edit the devel ﬁles and create new ﬁles in the devel directory. The ﬁles they create will always

retain their devel group status, so other devel users will always be able to edit them.

If you have multiple projects like devel and users who are working on multiple projects, these users

will never have to change their umask or group when they move from project to project. If set correctly,

the setgid bit on each project’s main directory "selects" the proper group for all ﬁles created in that

directory.

Since each user’s home directory is owned by the user and their private group, it is safe to set the

setgid bit on the home directory. However, by default, ﬁles are created with the primary group of the

user, so the setgid bit would be redundant.

6.4.1. User Private Group Rationale

Although the User Private Group (UPG) has existed in Red Hat Linux for quite some time, many

people still have questions about it, such as why UPG is necessary. Consider the following scenario.

You would like to have a group of people work on a set of ﬁles in the /usr/lib/emacs/site-lisp

directory. You trust a few people to modify the directory but certainly not everyone.

First, create an emacs group:

/usr/sbin/groupadd emacs

In order to associate the contents of the directory with the emacs group, perform the following com-

mand:

chown -R root.emacs /usr/lib/emacs/site-lisp

Now, it is possible to add the proper users to the group with gpasswd:

/usr/bin/gpasswd -a

username emacs

Allow the users to actually create ﬁles in the directory with the following command:

chmod 775 /usr/lib/emacs/site-lisp

When a user creates a new ﬁle, it is assigned the group of the user’s default private group. To prevent

this, perform the following command, which causes everything in the directory to be created with the

emacs group:

chmod 2775 /usr/lib/emacs/site-lisp

If the new ﬁle needs to be mode 664 for another user in the emacs group to be able to edit it, make the

default umask 002.

At this point, by making the default umask 002, you can easily set up groups that users can take

advantage of without any extra work every time users write ﬁles to the group’s common directory.

Just create the group, add the users, and do the above chown and chmod on the group’s directories.

1 2 ... 92 93 94 95 96 97 98 99 100 101 102 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 97