3 ms·
Since he's sysadmin in a university computer-science department (and going by the first paragraph of this post), I think group-type sharing is the specific use-
by mjn 11y ago
Since he's sysadmin in a university computer-science department (and going by the first paragraph of this post), I think group-type sharing is the specific use-case that the post author might be hypothetically tempted to solve using ACLs. Unix groups work for this but require the sysadmin to be involved every time you want a group created, users added/removed from the group, etc. It'd be nice in some cases if a regular user, say the PI of a project or the instructor of a course, could manage their own sharing permissions, without having to open support tickets every time they need a group created or modified.
Conceivably you could hack up a custom solution for this, where certain groups are tagged as "owned" by a user, and the user can run a setuid binary to add/remove members. Or do it via an authenticated web interface or something. Would require some careful design/testing to avoid being a security risk. There are more esoteric possible uses of ACLs this wouldn't solve, like giving certain users append-only permission to some files. But a way for users to manage their own groups would probably handle 90% of the likely uses of ACLs in this setting.
- icebraining 11y agoYou can use sudo for that, by allowing certain commands to be run by the PI, eg.: pi_account ALL= (root) groupadd course_* pi_account ALL= (root) usermod -a -G course_* * This would allow the PI to create groups with a certain prefix, and to add users to it.