Thank you Petr for your answer. I'm trying to do the job with least changes in client which was a operating machine now joined to Free IPA domain. I just want to make sure if using chmod, chown or setfacl are the only available solutions or not? <div class="gmail_quote">On Jun 28, 2016 12:30 PM, "Petr Spacek" <<a href="mailto:pspacek@redhat.com">pspacek@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 28.6.2016 09:08, Mitra Dehghan wrote: > Hello, > > I want to know how can I give directory permissions on a client to a domain > user in FreeIPA. > > > I'm using "runasuser" feature in sudo policy to give my domain users > permission to run local services on client. > > Here is an example: > I have a service on my client called "*abc*" located at "/home/abc/" and > locally run by local user called "*abc*" > > I have used runasuser feature in sudo policy rules to let domain users > (say: *usr@mydomain.dc*) run the service. *usr* can run scripts, read and > edit files and stop/start services, using *abc*'s permissions and without > any problem. > > But the problem I have faced is, when I want "*usr*" to traverse > subdirectories under "*/home/abc/*" it doesn't work. > I have defined sudocmd for cd command and added it as allow-command to > appropriate sudorule. my sudocmd definitions are like this: > > > *ipa sudocmd-add --desc="ttttttt" 'cd /home/abc/n/'* > > *ipa sudocmd-add --desc="ttttttt" 'cd /home/abc/m/'* > *ipa sudocmd-add --desc="ttttttt" 'cd /home/abc/n/q/'* > > While *usr* can run the *cd* command without error, it doesn't work and > *pwd* still shows* /home/usr* as current directory. > what *usr* runs is: > *$ sudo -u abc cd /home/abc/m*/ Most importantly you need to add appropriate permission for user abc to the /home/abc directory (and its contents if necessary). You can use either chown+chmod or setfacl commands, depending on the use-case. When this is one, add SUDO rule allowing user usr to run a program in question. You do not need to bother with SUDO rules for "cd" because this will be solved at filesystem level. -- Petr^2 Spacek -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote></div>