Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I can configure sudo (via the sudoers file) to allow a user to run the chown and chmod commands on any file or directory in the system. However, I only want to grant a user permission to run these commands on files that reside beneath the /var/www/html directory.

How can I restrict privileged commands such that the user may only run them in a pre-specified directory?

For example: The following command grants 777 permissions to index.html file.

sudo chmod 777 /var/www/html/index.html

Now I want to perform two actions

  1. Restrict sudo such that the user may only run chmod and chown from within /var/www/html

  2. Disallow the user from executing these commands elsewhere in the system (e.g. the commands cannot be run in /var/www or /var/ftp)

share|improve this question
Please don't crosspost - superuser.com/questions/456662/… –  Ulrich Dangel Aug 2 '12 at 11:22
Is this really the right way? How about a www-data group eliminating the need to chmod/chown anything? –  sr_ Aug 2 '12 at 11:23
Cool. That way you get root pretty easy. It is a very bad idea to give away chown. Apart from that I see no reason why chmod has to be run as root. –  Nils Aug 3 '12 at 19:38

3 Answers 3

up vote 6 down vote accepted

What you're asking is difficult if not impossible. Even if you did restrict the application of chown and chmod to files under a specific directory, someone could still pass a symbolic link and so affect files anywhere they like.

Fortunately, it's highly likely that what you're attempting to do is just not the right solution to your actual problem, and there is another method that works.

Usually, users who need additional permissions to create and modify files under /var/www are added to a group (often www-data, or you may have different groups for different parts of the site). You can use group ownership and setgid directories: chgrp www-data /var/www/html; chmod g+ws /var/www/html allows everyone in the www-data group to write to the /var/www/html directory, and files created in that directory will be owned by the www-data group instead of the primary group of the user who created the file. However, this is not very flexible.

What you probably should do is set up access control lists for files under /var/www. First, make sure that ACLs are enabled: the filesystem that /var/www is on must be mounted with the acl option. See Make all new files in a directory accessible to a group for help on that. Also install the ACL utilities (getfacl and setfacl). Then give extra permissions to the tree under /var/www/html to the users who should have them. You can set per-user ACLs, but it's often easier to put users who should have the same rights on a part of the filesystem in a group and set ACLs for that group. For example, if the users in the group html-writers should have read-write access to the tree under /var/www/html:

setfacl -d -m group:html-writers:rwx /var/www/html
setfacl -m group:html-writers:rwx /var/www/html
share|improve this answer

You can restrict the command to be used by "myuser" with all arguments in /etc/sudoers file with the command visudo add:

## Allows myuser to chmod the html dir and chmod 755 the html2 dir
myuser  ALL=NOPASSWD:/bin/chmod [0-7][0-5][0-5] /var/www/html/*,/bin/chown myuser:mygroup /var/www/html/*,/bin/chmod 755 /var/www/html2/myapp/*.txt 

enable logging for every operation adding:

Defaults logfile=/var/log/sudo.log

sample output:

[root@myhost /]# su - myuser
-sh-3.1$ sudo /bin/chmod 755 /var/www/html/index.html 
-sh-3.1$ sudo /bin/chmod 755 /var/www/html/*
-sh-3.1$ sudo /bin/chmod 777 /var/www/html2/myapp/*.txt
Sorry, user myuser is not allowed to execute '/bin/chmod 777 /var/www/html2/myapp/*.txt' as root on myhost.mydomain.
-sh-3.1$ sudo /bin/chmod 755 /var/www/html2/myapp/*.txt 

When you use sudo, the premise should be that "myuser" is a trusted person. Be carefull with file permissions, there is no a simple way to stop a malicious sudo user from link a file from an external resource and change it.

share|improve this answer
I have tried it before, but it gave the error as: Sorry, user prashant is not allowed to execute '/bin/chmod 777 /var/www/html/a' as root on prashant.xyz.com. –  PrashantB Aug 2 '12 at 12:11
have you switched user with su - prashant or su prashant? –  tombolinux Aug 2 '12 at 12:14
Yes I am executing command by prashant user. I read forums,they say commands run system-wide. No one has write about such issue. –  PrashantB Aug 2 '12 at 12:19
I run it whooo :). But this will be static command. Can we make it general so that I can apply any permission on any file under /var/www/html? –  PrashantB Aug 2 '12 at 12:22
This is completely insecure: sudo /bin/chmod 666 /var/www/html/../../../etc/passwd And if you somehow fix that, ln -s /etc /var/www/html/foo/etc; sudo /bin/chmod 666 /var/www/html/foo/etc/passwd –  Gilles Aug 2 '12 at 23:17

Try the following commands:

sudo chmod -R u+rx /var/www/html
sudo chown -R user:group /var/www/html

It'll set the permission and change the owner only for specified directory. If this is something what you meant.

share|improve this answer
This doesn't answer the question as stated, and I don't see how it would help with whatever underlying problem PrashantB is trying to solve. –  Gilles Aug 2 '12 at 23:21
I've improved the answer. –  kenorb Aug 3 '12 at 0:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.