Jogosultság beállítás probléma

Sziasztok!

A segítségeteket kérném az alábbi feladat megoldásában. Fontos lenne, hogy CentOS/Redhat alapon kellene a megoldás.

Create users lucy and lisa and make them members of the group support as a secondary group membership.
Create users bob and adam and make them members of the group marketing as a secondary group membership.
Create shared group directories /groups/sales and /groups/marketing and make sure these groups meet the following requirements:
- members of the group support have full access to their diretcory.
- members of the group marketing have full access to their directory.
- Users have persmissions to delete only their own files, but Bob is the boss, so user Bob has access to delete all user's files.

[root@localhost ~]# useradd lucy
[root@localhost ~]# useradd lisa
[root@localhost ~]# groupadd support
[root@localhost ~]# usermod -aG support lucy
[root@localhost ~]# usermod -aG support lisa
[root@localhost ~]# groupmems -l -g support
lucy  lisa
[root@localhost ~]# useradd bob
[root@localhost ~]# useradd adam
[root@localhost ~]# groupadd marketing
[root@localhost ~]# usermod -aG marketing bob
[root@localhost ~]# usermod -aG marketing adam
[root@localhost ~]# groupmems -g marketing -l
bob  adam
[root@localhost ~]#

(Minden usernek adtam jelszót és úgy próbálgattam velük a dolgokat lentebb. Minden userrel beléptem, touch-al hoztam létre velük üres fájlokat, amiket törölni akartam másik userrel és Bob-bal is)

# Innentől három különféle módon is próbáltam

---------------------------------------------------------------
1: SGID + sticky
---------------------------------------------------------------
[root@localhost ~]# mkdir -p /groups/support
[root@localhost ~]# mkdir /groups/marketing
[root@localhost ~]# chown .support /groups/support/
[root@localhost ~]# chown .marketing /groups/marketing/
[root@localhost ~]# chmod g+rwx /groups/support/
[root@localhost ~]# chmod g+rwx /groups/marketing/
[root@localhost ~]# chmod g+s,o+t /groups/support/
[root@localhost ~]# chmod g+s,o+t /groups/marketing/

[root@localhost ~]# ls -al /groups/
total 0
drwxr-xr-x.  4 root root       38 Jun  5 03:02 .
dr-xr-xr-x. 19 root root      271 Jun  5 03:01 ..
drwxrwsr-t.  2 root marketing   6 Jun  5 03:02 marketing
drwxrwsr-t.  2 root support     6 Jun  5 03:01 support
[root@localhost ~]#

[root@localhost ~]# setfacl -R -m u:bob:rwx /groups/
[root@localhost ~]# setfacl -m d:u:bob:rwx /groups/

[root@localhost ~]# getfacl /groups/
getfacl: Removing leading '/' from absolute path names
# file: groups/
# owner: root
# group: root
user::rwx
user:bob:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:bob:rwx
default:group::r-x
default:mask::rwx
default:other::r-x

[root@localhost ~]# getfacl /groups/support/
getfacl: Removing leading '/' from absolute path names
# file: groups/support/
# owner: root
# group: support
# flags: -st
user::rwx
user:bob:rwx
group::rwx
mask::rwx
other::r-x

[root@localhost ~]# getfacl /groups/marketing/
getfacl: Removing leading '/' from absolute path names
# file: groups/marketing/
# owner: root
# group: marketing
# flags: -st
user::rwx
user:bob:rwx
group::rwx
mask::rwx
other::r-x

[root@localhost ~]#

[bob@localhost marketing]$ ls -al
total 0
drwxrwsr-t+ 2 root marketing 56 Jun  5 03:13 .
drwxrwxr-x+ 4 root root      38 Jun  5 03:02 ..
-rw-rw-r--. 1 adam marketing  0 Jun  5 03:13 adam1
-rw-rw-r--. 1 adam marketing  0 Jun  5 03:13 adam2
-rw-rw-r--. 1 bob  marketing  0 Jun  5 03:13 bob1
-rw-rw-r--. 1 bob  marketing  0 Jun  5 03:13 bob2
[bob@localhost marketing]$ rm adam1
rm: cannot remove 'adam1': Operation not permitted
[bob@localhost marketing]$

# Bob nem tudja törölni

---------------------------------------------------------------
2: SGID nélkül, sticky nélkül, othersnek semmi
---------------------------------------------------------------

[root@localhost ~]# rm -rf /groups/
[root@localhost ~]# mkdir -p /groups/support
[root@localhost ~]# mkdir -p /groups/marketing
[root@localhost ~]# chown .support /groups/support/
[root@localhost ~]# chown .marketing /groups/marketing/
[root@localhost ~]# chmod 770 /groups/support/
[root@localhost ~]# chmod 770 /groups/marketing/
[root@localhost ~]# ls -la /groups/
total 0
drwxr-xr-x.  4 root root       38 Jun  5 03:21 .
dr-xr-xr-x. 19 root root      271 Jun  5 03:21 ..
drwxrwx---.  2 root marketing   6 Jun  5 03:21 marketing
drwxrwx---.  2 root support     6 Jun  5 03:21 support
[root@localhost ~]# setfacl -R -m u:bob:rwx /groups/
[root@localhost ~]# setfacl -m d:u:bob:rwx /groups/
[root@localhost ~]#

[lucy@localhost support]$ rm lisa1
rm: remove write-protected regular empty file 'lisa1'? y
[lucy@localhost support]$ ls -al
total 0
drwxrwx---+ 2 root support 45 Jun  5 03:24 .
drwxrwxr-x+ 4 root root    38 Jun  5 03:21 ..
-rw-rw-r--. 1 lisa lisa     0 Jun  5 03:23 lisa2
-rw-rw-r--. 1 lucy lucy     0 Jun  5 03:24 lucy1
-rw-rw-r--. 1 lucy lucy     0 Jun  5 03:24 lucy2
[lucy@localhost support]$

# Másik user is le tudta törölni

---------------------------------------------------------------
3: Csak sticky, othersnek semmi
---------------------------------------------------------------

[root@localhost ~]# rm -rf /groups/
[root@localhost ~]# mkdir -p /groups/support
[root@localhost ~]# mkdir -p /groups/marketing
[root@localhost ~]# chown .support /groups/support/
[root@localhost ~]# chown .marketing /groups/marketing/
[root@localhost ~]# chmod 770 /groups/support/
[root@localhost ~]# chmod 770 /groups/marketing/
[root@localhost ~]# chmod o+t /groups/support/
[root@localhost ~]# chmod o+t /groups/marketing/
[root@localhost ~]# setfacl -R -m u:bob:rwx /groups/
[root@localhost ~]# setfacl -m d:u:bob:rwx /groups/

[bob@localhost support]$ ls -al
total 0
drwxrwx--T+ 2 root support 58 Jun  5 03:27 .
drwxrwxr-x+ 4 root root    38 Jun  5 03:25 ..
-rw-rw-r--. 1 lisa lisa     0 Jun  5 03:27 lisa1
-rw-rw-r--. 1 lisa lisa     0 Jun  5 03:27 lisa2
-rw-rw-r--. 1 lucy lucy     0 Jun  5 03:27 lucy1
-rw-rw-r--. 1 lucy lucy     0 Jun  5 03:27 lucy2
[bob@localhost support]$ rm lisa1
rm: remove write-protected regular empty file 'lisa1'? y
rm: cannot remove 'lisa1': Operation not permitted
[bob@localhost support]$

# Bob nem tudja törölni

Szerintetek hogyan lenne megoldható a feladat? :)