Day 02: Ownership and groups

Permissions are meaningless without ownership: rw- for the group only matters once you know which group. This is the lab where "add the user to the group" stops being a magic incantation.

1. See ownership, in names and numbers

mkdir -p ~/labs/own && cd ~/labs/own
touch file.txt
ls -l file.txt
stat -c '%U:%G %u:%G %n' file.txt

Ownership is stored as numbers. The names come from /etc/passwd and /etc/group, which is why a file copied to another machine can show a stranger's name — or a bare number, when no name maps to that uid.

2. Change owner and group

sudo chown root file.txt
ls -l file.txt
sudo chown root:root file.txt
ls -l file.txt
sudo chgrp "$(id -gn)" file.txt
ls -l file.txt

chown user:group does both at once and is the form to use. Note you needed sudo: giving a file away is a privileged act, because otherwise you could dodge a disk quota by donating your files to someone else.

3. Create a group and a shared directory

sudo groupadd -f labteam
sudo useradd -m -s /bin/bash alice
sudo useradd -m -s /bin/bash bob
sudo usermod -aG labteam alice
sudo usermod -aG labteam bob
getent group labteam

-aG is the flag that matters. -G alone replaces every supplementary group the user had; forgetting the a is how you remove someone's sudo access by accident while adding them to a project.

4. Make the directory actually shared

sudo mkdir -p /srv/shared
sudo chown root:labteam /srv/shared
sudo chmod 770 /srv/shared
sudo -u alice touch /srv/shared/from-alice.txt
sudo -u bob touch /srv/shared/from-bob.txt
ls -l /srv/shared

Both writes succeed. But look at the group on the new files — each belongs to the creator's own primary group, so bob may not be able to edit alice's file. Fix it with the setgid bit:

sudo chmod 2770 /srv/shared
sudo -u alice touch /srv/shared/second-from-alice.txt
ls -l /srv/shared

The leading 2 sets setgid on the directory, which makes every new entry inherit the directory's group instead of the creator's. This is the standard shape for a shared project directory.

5. Prove the boundary holds

sudo useradd -m -s /bin/bash carol
sudo -u carol ls /srv/shared
sudo -u carol touch /srv/shared/from-carol.txt

Both fail. carol is not in labteam, and 770 gives others nothing at all. That is the whole mechanism: membership, not passwords.

Clean up

sudo rm -rf /srv/shared
sudo userdel -r alice; sudo userdel -r bob; sudo userdel -r carol
sudo groupdel labteam
cd ~ && rm -rf ~/labs/own

Where this goes next

You created three users with useradd and did not think about what that actually made. Tomorrow: what a user account really consists of, and every place one is recorded.