I have a shared directory at /photos containing subdirectories such as /photos/a, /photos/b, and /photos/c. Each subdirectory should be accessible only to its corresponding group: groupa, groupb, or groupc. Members should be able to list, create, and manage files in their own directory, while users outside the group should not be able to list or even discover the other directories. I tried using permissions like 1770 and assigning ownership such as root:groupa, but unauthorized users can still see the directory names. I also tried changing /photos to 770, which prevented access entirely, possibly because users reach it through a bind mount. What permissions and group setup provide this behavior, and how might this work with SFTP?
3 Answers
The basic layout is possible with normal Unix permissions: make `/photos` owned by root and use mode 711, then make each child directory owned by `root:groupa`, `root:groupb`, and so on with mode 2770. Users need to be members of the appropriate group, and every directory in the path—including any bind-mounted path—must provide the required execute permission. If a user gets permission denied, check the complete path, group membership, and whether the SFTP service applies its own chroot or access restrictions.
You cannot hide individual directory entries while still allowing users to list the same parent directory. Directory read permission controls listing: users either get a listing of the parent or they do not. However, you can remove read permission from the parent while retaining execute permission, for example `chmod 711 /photos`. Users can then traverse `/photos` if they already know the path, but they cannot run `ls` to discover its contents. Set each subdirectory to its group with something like `chown root:groupa /photos/a` and use `chmod 2770 /photos/a`. The leading 2 is SGID, which makes newly created files inherit the directory's group. Add the sticky bit only if users should be prevented from deleting or renaming one another's files; that would be `chmod 3770 /photos/a`.
A bind mount does not bypass permissions. It creates another path to the same inode, so the permissions and ownership on the underlying directories still apply. Also, `1770` is not just 'group access': the first digit enables the sticky bit. For shared group directories, `2770` is usually the intended mode because SGID preserves group ownership on new files. If SFTP users must navigate normally, consider giving each group its own SFTP-visible root instead of exposing one parent that cannot be listed.
The parent directory must have execute permission for users to reach a known child path, but not read permission if you want to prevent directory listings. Be aware that some SFTP clients do not handle an unlistable parent gracefully, so separate SFTP roots or bind mounts may be more reliable.