Re: setgid - its current use

[Albert Cahalan <albert@users.sf.net>]

Dhruv Gami writes:
> On Thu, 8 Apr 2004, Denis Vlasenko wrote:
>> On Thursday 08 April 2004 04:46, Dhruv Gami wrote:

>>> I'd like to know the possibility of using setgid for users
>>> to switch their groups and work as a member of a particular
>>> group. Essentially, if i want one user, who belongs to
>>> groups X, Y and Z to create a file as a member of group Y
>>> while he's logged on as a member of group X, would it be
>>> possible through setgid() ?
>>
>> it is possible through chmod
>
> but that would be an explicit way of doing it, right ?
> I'm looking for doing this via some system calls or something
> transparent to the user. At  most I'd like to query the user
> for the group as which he wants to work. Which would
> essentially be a question I ask at login or beginning of a 
> session.

I think you need user-private groups and setgid directories.

First of all, ensure that each user has a group of
their own. Do NOT put all users into a "users" group.
So user "gami" would be in group "gami", or maybe
a "gami_group" group if you prefer. Have the home
directories owned by these groups.

Second, set the umask to allow group write access.
(this is why you need the user-private groups)

Now suppose you have two users, bill and tom,
who need to work together on the spamming project.
Create a group called "spamming". Create a project
directory /projects/spamming owned by root and
in the spamming group. Make this directory setgid
and group writable. Any files created in this
directory will be owned by the spamming group.
Due to the umask setting, permissions on these
new files will allow access by all group members.
The setgid bit will propagate to any newly created
directories, but not to newly created files.