How to add a group to an ACL in ubuntu

3.4k views Asked by At

Problem

I need to give read/write access to a system group called "mongodb" on a USB key that's been formatted as ext4. It seems that the command worked, but when I try to have the system user write to this folder, I get a permissions error:

2014-11-11T10:41:19.326-0500 [initandlisten] exception in initAndListen std::exception: boost::filesystem::status: Permission denied: "/media/me/mongotest/mongodb", terminating

Here's the command I used to check that this group has access:

me@medev:~$ getfacl /media/me/mongotest/mongodb/
getfacl: Removing leading '/' from absolute path names
# file: media/me/mongotest/mongodb/
# owner: root
# group: root
user::rwx
group::r-x
group:mongodb:rwx
mask::rwx
other::r-x

Additional Test

Just to prove it was working, I did the following:

  1. create a new user in ubuntu called "test".
  2. created a new group called testers
  3. added test to testers.
  4. added testers to ACL list for /media/me/mongotest/mongodb folder on the usb:
 me@medev:~$ getfacl /media/me/mongotest/mongodb/
 getfacl: Removing leading '/' from absolute path names
 # file: media/me/mongotest/mongodb/
 # owner: root
 # group: root
 user::rwx
 group::r-x
 group:mongodb:rwx
 group:testers:rwx
 mask::rwx
 other::r-x
  1. Then I changed user to "test":
me@medev:~$ su test
Password:
  1. Tried to change directories into the USB key like so:
test@medev:/home/me$ cd /media/me/mongotest
bash: cd: /media/me/mongotest: Permission denied
test@medev:/home/me$ cd /media/me/mongotest/mongodb
bash: cd: /media/me/mongotest/mongodb: Permission denied
test@medev:/home/me$

So it would seem that I'm doing something wrong with the way I'm creating / adding these permissions... because it's failing for both users / groups.

1

There are 1 answers

0
dot On BEST ANSWER

I had to set the ACL at the /media/me level.

So i did this:

setfacl -m g:mongodb:rwx /media/me

I assumed I had to include "mongotest" in the path because that's the name I assigned to the volume / filesystem. But I guess that's not the case.