Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I can run chown and chmod commands by sudo system-wide, but want to run these commands in only /var/www/html directory.

How can restrict commands to run only in specified directory by sudo permission? Not system-wide.

Example: By following command 777 permission applied to index.html file.

sudo chmod 777 /var/www/html/index.html

Now I want to perform two actions

  1. Restrict sudo to run chmod and chown only in /var/www/html

  2. These command should not run in other places/directory.i.e user cannot use this command in /var/www or /var/ftp

share|improve this question
1  
Please don't crosspost - superuser.com/questions/456662/… –  Ulrich Dangel Aug 2 '12 at 11:22
7  
Is this really the right way? How about a www-data group eliminating the need to chmod/chown anything? –  sr_ Aug 2 '12 at 11:23
    
Cool. That way you get root pretty easy. It is a very bad idea to give away chown. Apart from that I see no reason why chmod has to be run as root. –  Nils Aug 3 '12 at 19:38
add comment

3 Answers

up vote 6 down vote accepted

What you're asking is difficult if not impossible. Even if you did restrict the application of chown and chmod to files under a specific directory, someone could still pass a symbolic link and so affect files anywhere they like.

Fortunately, it's highly likely that what you're attempting to do is just not the right solution to your actual problem, and there is another method that works.

Usually, users who need additional permissions to create and modify files under /var/www are added to a group (often www-data, or you may have different groups for different parts of the site). You can use group ownership and setgid directories: chgrp www-data /var/www/html; chmod g+ws /var/www/html allows everyone in the www-data group to write to the /var/www/html directory, and files created in that directory will be owned by the www-data group instead of the primary group of the user who created the file. However, this is not very flexible.

What you probably should do is set up access control lists for files under /var/www. First, make sure that ACLs are enabled: the filesystem that /var/www is on must be mounted with the acl option. See Make all new files in a directory accessible to a group for help on that. Also install the ACL utilities (getfacl and setfacl). Then give extra permissions to the tree under /var/www/html to the users who should have them. You can set per-user ACLs, but it's often easier to put users who should have the same rights on a part of the filesystem in a group and set ACLs for that group. For example, if the users in the group html-writers should have read-write access to the tree under /var/www/html:

setfacl -d -m group:html-writers:rwx /var/www/html
setfacl -m group:html-writers:rwx /var/www/html
share|improve this answer
add comment

You can restrict the command to be used by "myuser" with all arguments in /etc/sudoers file with the command visudo add:

## Allows myuser to chmod the html dir and chmod 755 the html2 dir
myuser  ALL=NOPASSWD:/bin/chmod [0-7][0-5][0-5] /var/www/html/*,/bin/chown myuser:mygroup /var/www/html/*,/bin/chmod 755 /var/www/html2/myapp/*.txt 

enable logging for every operation adding:

Defaults logfile=/var/log/sudo.log

sample output:

[root@myhost /]# su - myuser
-sh-3.1$ sudo /bin/chmod 755 /var/www/html/index.html 
-sh-3.1$ sudo /bin/chmod 755 /var/www/html/*
-sh-3.1$ sudo /bin/chmod 777 /var/www/html2/myapp/*.txt
Sorry, user myuser is not allowed to execute '/bin/chmod 777 /var/www/html2/myapp/*.txt' as root on myhost.mydomain.
-sh-3.1$ sudo /bin/chmod 755 /var/www/html2/myapp/*.txt 
-sh-3.1$ 

When you use sudo, the premise should be that "myuser" is a trusted person. Be carefull with file permissions, there is no a simple way to stop a malicious sudo user from link a file from an external resource and change it.

share|improve this answer
    
I have tried it before, but it gave the error as: Sorry, user prashant is not allowed to execute '/bin/chmod 777 /var/www/html/a' as root on prashant.xyz.com. –  PrashantB Aug 2 '12 at 12:11
    
have you switched user with su - prashant or su prashant? –  tombolinux Aug 2 '12 at 12:14
    
Yes I am executing command by prashant user. I read forums,they say commands run system-wide. No one has write about such issue. –  PrashantB Aug 2 '12 at 12:19
    
I run it whooo :). But this will be static command. Can we make it general so that I can apply any permission on any file under /var/www/html? –  PrashantB Aug 2 '12 at 12:22
1  
This is completely insecure: sudo /bin/chmod 666 /var/www/html/../../../etc/passwd And if you somehow fix that, ln -s /etc /var/www/html/foo/etc; sudo /bin/chmod 666 /var/www/html/foo/etc/passwd –  Gilles Aug 2 '12 at 23:17
show 6 more comments

Try the following commands:

sudo chmod -R u+rx /var/www/html
sudo chown -R user:group /var/www/html

It'll set the permission and change the owner only for specified directory. If this is something what you meant.

share|improve this answer
    
This doesn't answer the question as stated, and I don't see how it would help with whatever underlying problem PrashantB is trying to solve. –  Gilles Aug 2 '12 at 23:21
    
I've improved the answer. –  kenorb Aug 3 '12 at 0:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.