1 |
On Thu, Mar 17, 2016 at 4:59 PM, Alan McKinnon <alan.mckinnon@×××××.com> wrote: |
2 |
> |
3 |
> umask is just not viable either, as a) it's global and affects all files |
4 |
> a user creates and b) by definition umask is modifiable by the user |
5 |
> (it's a feature to help users out so they don't need to chmod every file |
6 |
> every time) and c) you can't stop them doing it (by design). |
7 |
|
8 |
Actually, this is completely viable. Just set the default umasks to |
9 |
007, and create a new group for each user as their default group (and |
10 |
don't have all their home directories be owned by some users group). |
11 |
This is how this sort of situation was handled long before POSIX ACLs |
12 |
became common, and I know that some distros behave this way by default |
13 |
for this reason (this was the case in the distro I used right before I |
14 |
switched to Gentoo). |
15 |
|
16 |
If users chmod a file then tell them not to. If you must, set up some |
17 |
cron job to clean up after them. |
18 |
|
19 |
But, you can of course do this with ACLs as well. I haven't tried |
20 |
setting those up personally. |
21 |
|
22 |
-- |
23 |
Rich |