I have installed Radicale with pip on Linux, the version I am running is 3.7.2.
I have created a non-root user account called radicale for the calendar server. Another non-root user account called backup_operator is doing file backups.
The radicale home directory does not allow other users to traverse it (permissions drwxr-x---). I thought I could give backup_operator read access to radicale home directory like this:
# Allow user 'backup_operator' to enter the home directory of the 'radicale' user.
sudo setfacl --modify "user:backup_operator:--X" "/home/radicale"
That seems to work, as user backup_operator is able to descend down to this directory:
/home/radicale/radicale-data/collections/collection-root/some_username/
However, Radicale has created the subdirectory with the collection 12345678-abcd-1234-5678-9abcdef01234 without o:r-x permission, so that other users cannot descend into it.
Again, I thought this would fix it:
chmod o+rx /home/radicale/radicale-data/collections/collection-root/some_username/12345678-abcd-1234-5678-9abcdef01234
That seemed to work, as user backup_operator was able to descend down for a while.
The trouble is, Radicale seems to recreate the whole directory 12345678-abcd-1234-5678-9abcdef01234 every time a calendar event is added. That was unexpected.
I noticed because I left a shell open in that directory, and after adding a calendar event, the current directory was invalid.
I wonder why Radicale needs to recreate the whole directory whenever you add a calendar event.
More importantly, the last time I added an event with Thunderbird, all other events were lost. There were no errors in the log. I wonder whether the permissions were wrong and Radicale was not able to move or copy the .ics files when recreating the collection directory.
Radicale does have a folder_umask option, but that will not help, will it? First of all, a mask only subtracts permissions, and I need to add "o:r-x". Besides, I also need the "o:r-x" permissions in the .ics files, not just on the parent directory.
How do people work around this kind of permission trouble? I don't really want to use root for backup purposes.
I have installed Radicale with pip on Linux, the version I am running is 3.7.2.
I have created a non-root user account called
radicalefor the calendar server. Another non-root user account calledbackup_operatoris doing file backups.The
radicalehome directory does not allow other users to traverse it (permissions drwxr-x---). I thought I could givebackup_operatorread access toradicalehome directory like this:That seems to work, as user
backup_operatoris able to descend down to this directory:/home/radicale/radicale-data/collections/collection-root/some_username/However, Radicale has created the subdirectory with the collection
12345678-abcd-1234-5678-9abcdef01234without o:r-x permission, so that other users cannot descend into it.Again, I thought this would fix it:
That seemed to work, as user
backup_operatorwas able to descend down for a while.The trouble is, Radicale seems to recreate the whole directory
12345678-abcd-1234-5678-9abcdef01234every time a calendar event is added. That was unexpected.I noticed because I left a shell open in that directory, and after adding a calendar event, the current directory was invalid.
I wonder why Radicale needs to recreate the whole directory whenever you add a calendar event.
More importantly, the last time I added an event with Thunderbird, all other events were lost. There were no errors in the log. I wonder whether the permissions were wrong and Radicale was not able to move or copy the .ics files when recreating the collection directory.
Radicale does have a
folder_umaskoption, but that will not help, will it? First of all, a mask only subtracts permissions, and I need to add "o:r-x". Besides, I also need the "o:r-x" permissions in the .ics files, not just on the parent directory.How do people work around this kind of permission trouble? I don't really want to use root for backup purposes.