# Quesion on permissions in Linux **URL:** \ **Category:** UNIX for Beginners Q & A\ **Created:** [November 30, 2021, 4:13pm UTC](https://community.unix.com/t/quesion-on-permissions-in-linux/384682 "2021-11-30T16:13:29Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![resistance](https://community.unix.com/letter_avatar/resistance/32/6_22734026db12803ebb3e059622ac3534.png) [@resistance](https://community.unix.com/u/resistance)\ **Post date:** [November 30, 2021, 4:13pm UTC](https://community.unix.com/t/quesion-on-permissions-in-linux/384682/1 "2021-11-30T16:13:29Z")
Linux version : RHEL 7.9 In my shop, me a my colleagues use a RHEL jump server. Each employee has its own login and home directories like ``` /home/johndoe /home/katie /home/steve ``` Each employee logs in to this server via their individual ID and it is authenticated via Microsoft Active Directory (I think). So, once johndoe logs in, he can switch to appuser by runing `su -iu appuser`. Now, appuser wants to copy a file to a directory called johns\_Subdir located in johndoe's home directory. johndoe has already granted `chmod -R 777 johns_Subdir` so that anyone can write to `johns_Subdir`. But, `appuser` still cannot copy a file to ` /home/johndoe/johns_Subdir`. It is probably because appuser does not have write privileges on johns\_Subdir's parent directories `/home/johndoe`. ``` appuser@jumpserverp235:~ $ cp /home/appuser/appLog1.txt /home/johndoe/johns_Subdir cp: failed to access ‘/home/johndoe/johns_Subdir’: Permission denied appuser@jumpserverp235:~ $ appuser@jumpserverp235:~ $ ls -ld /home/johndoe drwx------. 8 johndoe appadmin 280 Nov 30 16:26 /home/johndoe appuser@jumpserverp235:~ $ cd /home/johndoe bash: cd: /home/johndoe: Permission denied appuser@jumpserverp235:~ $ ``` But, johndoe does not want to give write privileges to anyone for `/home/johndoe`. So, what is the solution for this ? I mean, how can johndoe let just `appuser` user to write files in `/home/johndoe/johns_Subdir` directory ? ---
**Author:** ![vbe](https://community.unix.com/user_avatar/community.unix.com/vbe/32/266_2.png) [@vbe](https://community.unix.com/u/vbe)\ **Post date:** [November 30, 2021, 4:24pm UTC](https://community.unix.com/t/quesion-on-permissions-in-linux/384682/2 "2021-11-30T16:24:47Z")
No one except johndoe can traverse his home directory because its missing execute perms. it should be drwx--x--x johndoe should do ``` chmod 711 /home/johndoe ``` ---
**Author:** ![MadeInGermany](https://community.unix.com/letter_avatar/madeingermany/32/6_22734026db12803ebb3e059622ac3534.png) [@MadeInGermany](https://community.unix.com/u/MadeInGermany)\ **Post date:** [November 30, 2021, 6:20pm UTC](https://community.unix.com/t/quesion-on-permissions-in-linux/384682/3 "2021-11-30T18:20:25Z")
Yes the x bit on a directory controls access ("axess"). An r bit in addition controls read/browse access - not needed here. It's better to have a shared directory outside a private home directory. Like `/proj/group_dir` Or `/home/group_dir` if `group_dir ` never conflicts with a username. See also > [@Tip: group-writable directory](https://community.unix.com/t/tip-group-writable-directory/383754): > > Often there is a need for a "project" directory where all group members have write access. In theory this is a bit risky in case more than one user opens the same file; if both do changes then you don't know what you get. So either there is a good coordination in the group, or the files are opened with an application that tells you if it's in use. How to make a group-writable directory in LUnix? The best approach is chmod 2770 on directories, that is full read+write+execute rights for user(o… ---
**Author:** ![Azhrei](https://community.unix.com/letter_avatar/azhrei/32/6_22734026db12803ebb3e059622ac3534.png) [@Azhrei](https://community.unix.com/u/Azhrei)\ **Post date:** [November 30, 2021, 10:00pm UTC](https://community.unix.com/t/quesion-on-permissions-in-linux/384682/4 "2021-11-30T22:00:18Z")
The solutions provided will work and are a good fix, but keep in mind that anyone who knows the name of that directory (`johns_Subdir`) has been given read/write access and that could be dangerous. For example, say that the `appuser` generated a file containing salary information for everyone in the company and John wants that file copied to his own directory; since everyone else can read/write that directory, they could retrieve that information and even edit the report! If you want to allow access to a single user other than John, you have two approaches. The first is to create a group that contains only `johndoe` and `appuser`, then give the directory ownership to that group, specifying permissions of `rwxrwx---` (this prevents anyone else on the system from seeing the contents of the directory). This is flexible since other users could be added to the group in the future without changing the directory permissions, but creating/editing groups can only be done by the sys admin. Another option is to use _access control lists_ (ACLs). These allow permissions on individual files and directories to be specified for specific users and groups, so you could say that Bob and Alice have rwx, Chuck and Dan have rw-, and the Payroll group has r-x, for example. ACLs can be created by users without support from the sys admin. (Warning: ACLs can be difficult to backup and restore unless the sys admin is familiar with them and knows the proper procedures to use, so check with them if you think this is a good solution. The group solution in the previous paragraph doesn't require any special processing for such things.) Of course, the final option is to sidestep the entire issue and instead of `appuser` copying into John's directory, have John copy the files _from_ the original location. The same permission solutions listed above can be used, but turning the operation might make it easier to manage, since instead of it being John's, and Katie's, and Steve's responsibility to create their directories correctly, it's the `appuser`'s responsibility to set up the original location permissions correctly (and it only needs to be done once). ---
**Author:** ![system](https://community.unix.com/uploads/default/original/2X/c/c7e9e16a595259edafe88615719d5c5dcda035c2.png) [@system](https://community.unix.com/u/system)\ **Post date:** [January 30, 2022, 2:17am UTC](https://community.unix.com/t/quesion-on-permissions-in-linux/384682/6 "2022-01-30T02:17:44Z")
Closed on January 30, 2022, 2:17am UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.