Adding Sarah to the group backups could give her access to things she should not have access to.
Although it has it's own administrative nightmare, you could always use facl's and add user group Sarah with read. setfacl -m u:sarah:r /path/target . setfacl -m g:sarah:r /path/target On Thu, 18 Jun 2026 16:49:03 +0100, z/OS scheduler <[email protected]> wrote: >Regarding the 777 permission, that is a bit hard handed? > >In my not so humble opinion, the group needs to be used. > >If the owner of the file is Johnny, and the group it is in is backups(just >an example), but Sarah(who is probably Sarah:Sarah) need read access too, >then Sarah need to be added to a secondary group, in my example it is >backups. >something like this: >Before this command is issued, the [ grep backups /etc/group ] command >should NOT show Sarah as part of the backups group, if it does... there is >another problem. ># usermod -a -G backups Sarah >After this command is issued, the [ grep backups /etc/group ] command >should show Sarah as part of the backups group > >Having said all that, if the backup group only needs read access, it will >by (owner)7(Group)5(Rest of the World and their pets)5, but if the backup >group needs it all(R,W,E,D), then it will be 775. > > >Kind Regards > >James > >Op do 4 jun 2026 om 23:37 schreef Andrew Rowley < >[email protected]>: > >> On 4/06/2026 7:49 pm, Robert S. Hansel wrote: >> > It is my understanding that /etc/rc is executed by BPXOINIT at startup. >> If its ID has UID(0), you need not change the Owner. >> >> That's almost certainly true. >> >> However, while it's very unlikely, I think it is possible to run a Java >> task from /etc/rc that could create the directory with another user. So >> it seemed like cheap insurance to explicitly set the owner, then you are >> protected if somehow things change in the future. >> >> -- >> Andrew Rowley >> Black Hill Software >> >> ---------------------------------------------------------------------- >> For IBM-MAIN subscribe / signoff / archive access instructions, >> send email to [email protected] with the message: INFO IBM-MAIN >> > >---------------------------------------------------------------------- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
