Back to problem
Systems Administrator ICoreDirectory Collaboration~35-45 min

The Shared Reports Directory

Analysts can already get into /srv/reports. So why can't they edit each other's files?

Your goal

Your goal is not simply to make one file editable by two people. Your goal is to design the directory's future so every file created from now on is collaborative by default, without ever making it public. Two separate mechanisms decide that outcome, and neither one alone is the whole story: setgid on the directory decides which group a brand-new file inherits, while umask decides which permission bits a brand-new file is allowed to keep. Get the group right but the mode wrong, and analysts still can't write to each other's files. Get the mode right but the group wrong, and the write permission points at the wrong group entirely. Real administration means understanding both, persisting both, and then proving the combination actually works — for insiders and for outsiders.

Diagnose
Predict
Inherit
Persist
Verify

Finance analysts share /srv/reports for collaborative work, but every new file lands with a different group and a different mode, so one analyst's file quietly locks the next analyst out.

01

Fixing today's file doesn't fix tomorrow's

Look at what's already on disk:

ls -l /srv/reports
-rw-rw-r-- 1 analyst1 analyst1     report-a.csv
-rw-r--r-- 1 analyst2 analyst2     report-b.csv
-rw-rw---- 1 analyst1 finance-report report-c.csv

Three files, three different groups, three different modes — even though every analyst is supposedly working in the same shared directory.

Suppose you run chmod 660 report-b.csv:

  • That repairs report-b.csv
  • Tomorrow, someone creates report-d.csv — and it's wrong again, for the exact same reason report-b.csv was wrong today
  • You fixed the current state of one file
  • You did nothing about the future creation policy that produced it
chmod one existing file
fixed today, wrong again tomorrow
vs
fix the creation policy
every future file is correct automatically
REAL FIX
Back to this problem

Keep this distinction in mind for the rest of this problem: existing objects and future objects are two separate concerns, fixed by two separate actions. A correct answer here has to survive a file that doesn't exist yet.

Knowledge check 0

report-b.csv has the wrong group and mode. You chmod and chgrp it back to what it should be.

Is /srv/reports now fixed for good?