Can I run a command with specific privileges on certain directories?

Question

I would like to be able to run a command, passing in parameters to bash or similar, such that this command is not allowed to write to a particular path, overriding the user's other privs.

Eg:

root> /bin/bash -protect /folder/to/protect mycommand.sh

In this example, the root user can obviously do what it wants, but while I test a new script I'm writing, I would like to protect a folder, as if the folder was read only for that user.

Is there a way to do this without adding a new user and adjusting that user's privs accordingly? It doesn't have to be in bash by the way, I don't mind the approach - as long as I can protect folders without adding a new user I don't mind!

(I'm sorry about the title, I can't really think of how to explain my requirements in one line!)

Answer 1

Unix's security is built on permissions for users and groups. If you want to make a directory read-only for a command, you need to run it as a user who isn't allowed to write to that directory. Or there's a heavier-handed approach, which is to run the command in a virtual machine.

You may find bindfs useful. Bindfs is a stacked filesystem, that is, it creates an alternate view of a part of the directory tree. In particular, you can create a read-only view, or a view with different permissions. Bindfs can't make /folder/to/protect read-only, but it can create a read-only view of that directory /read/only/view; you need to find some other means (such as permissions) of preventing the command from writing in `/folder/to/protect.

bindfs --perms=a-w /folder/to/protect /read/only/view

Answer 2

You could write a shared library which implemented a wrapper around open which performed the additional security check(s) you want. The program you write can then use can then use LD_PRELOAD to load your shared library when invoking the program and override the system's open.

You may need to override other system calls to ensure there is not an alternative way for the program to achieve what it's trying to do.