Hot answers tagged

13

There is a little problem with sed's inplace editing mode -i. sed creates a temporary file in the same directory called sedy08qMA, where y08qMA is a randomly generated string. That file is filled with the modified contents of the original file. After the operation, sed removes the original file and renames the temporary file with the original filename. So ...


8

The -i parameter of sed works by creating a temp file during operation, then overwrite the actual file with the temp file in the end. That's the most likely the cause of the problem, since when creating the temp file ownership defaults to myuser:myuser You can set the setgid bit on the parent directory(only if the parent directory is owned by group ...


5

You can't edit the contents of the public directory if you don't have write access. You indicate you are attempting to create a new file. If the test file doesn't already exist in public, touch will attempt to create a new file. It cannot do this without the ability to write to the directory listing to add the new inode entry. Apparently, you don't have ...


5

Do not add yourself to the root group, this many have many unintended side effects granting more than you intended. These directories are intentionally not writable by normal users. In the event you need to make manual changes to them (which will be rare), you can perform those operations as root via sudo.


3

Many operations on directories require execute (search) permission in addition to read permission. chmod 666 clears the x bits, causing strange failures of ls and other basic stuff. Reasonable default permissions might be 644 for files and 755 for directories.


3

If you want to install Python packages from source, you should do so in a virtualenv. That way you minimize the chance that you break your system's python, and it you make it possible to just remove the installed package without fear of removing too much. In order to do so you must first install virtualenv, e.g. using sudo apt-get install ...


3

When determining access permissions using Unix-style permissions, the current user is compared with the file's owner, then the group, and the permissions applied are those of the first component which matches. Thus the file's owner has the owner's permissions (and only those), members of the file's group have the group's permissions (and only those), ...


2

To set the quota for a filesystem: zfs set quota=20TB poolname/backup-filesystem To query the current quota setting: zfs get quota poolname/backup-filesystem Note that quotas can only be set on ZFS filesystems (i.e. made with zfs create pool/fsname), not on subdirectories (made with mkdir). subdirectories of a ZFS filesystem are included within that ...


2

short answer : You can't execute arbirary admin command without either a sudo or being root. long answer : You must either have NOPASSWD in /etc/sudoers, or log as root. (see http://askubuntu.com/questions/147241/execute-sudo-without-password ) visudo then add a line username ALL=(ALL) NOPASSWD: ALL


2

Yes setfacl should do it. Try the below, does it work ? setfacl -m u:user:--- file Where: -m is to modify the file/directory ACL user is the username for which you want to change permission --- will be the no permissions, replacing r,w,x file is the name of the file for which you want to change permissions


2

Assuming john does not bear uid 0, john would have no permissions, as john is a member of the group, and the permission check would not consider the world bits because of the group match (source: "Advanced Programming in the Unix Environment", chapter 4, section 5, p. 80 in the first edition.) 642 would result in the 4 bits being applied for the same reason. ...


2

You seem to have got it pretty well figured out; it is discussed a bit more here.  The one point that you may have missed is that you found the statement in the man page for touch(1) and not creat(2), because (with the possible exception of symbolic links), there are no system-level defaults — each program has its own individual default.  It just so happens ...


2

Yes, they can. $ id foo uid=1002(foo) gid=1002(foo) groups=1002(foo) $ id bar uid=1003(bar) gid=1003(bar) groups=1003(bar) Changing the primary group of user foo to bar which is the primary group for user bar: $ sudo usermod -g bar foo Now: $ id foo uid=1002(foo) gid=1003(bar) groups=1003(bar) $ id bar uid=1003(bar) gid=1003(bar) groups=1003(bar) ...


2

I would go for using ssh and restrict the command(s) that can be run by that user. At least that way you know the connection is secure. You can do so through an entry in /etc/ssh/sshd_config: Match User your_user X11Forwarding no AllowTcpForwarding no ForceCommand your-command arg1 arg2 This might work for you if you, through the arguments, can ...


2

cd is builtin command: $ type cd cd is a shell builtin You can't run it via sudo You can use the following command: sudo -i


1

I forgot something else. If I can't write to a file, I can still remove it and replace it. And that's exactly the correct way to save a file. (Because you have to fsync() before you have a durable file, which you can safely replace the old one with). It seems to work fine, you just have to ignore the padlocks :). E.g. I can rotate photos copied in by ...


1

The only way to accomplish this without resorting to ACLs is, Permissions set to 750 and your username being a member of every other user's primary group. For instance, lets say you have these users: me user1 otheruser /home will look something like this: drwxr-x--- 2 me me 4096 Mar 3 12:14 me drwxr-x--- 24 user1 user1 4096 Apr ...


1

This question is primarily opinion, but I'll go ahead and give you mine. In this case, I don't think it could be considered "bad practice", but in a larger (i.e. corporate) environment, it probably would be. On an RPi at home, go for it - if it were a corporate server that I were a co-admin on, I'd have to object to doing so.


1

If you call a user script in the users home (editable by the user) with root permissions, that effectively means the user is root. From a security / principle of least privilege point of view, that's a very bad thing to do. Of course, in your case it might not matter. As long as you know what you are doing and what the possible repercussions are, and if you ...


1

I often use rsync for saving file permissions while copying. rsync [OPTION...] SRC... [DEST] Using the -p option will preserve permissions: -p, --perms      preserve permissions and using -a (archive) will add a few more options: -a, --archive      archive mode; equals -rlptgoD (no -H,-A,-X) See man ...


1

Where is this tracked? How does the gpasswd command know who has been granted elevated permissions? It's not really "tracked", per se. gpasswd has rules for which users have permission to use the command in various ways, and those rules/permissions are tested on every run of the command. The results of those tests are not cached or stored. In ...


1

The permissions for files (subject to umask) are set in the open call when the file is first created. In fopen, the permissions are set to 0666, but that deals with stream I/O. Depending on the application which creates the files, they may use the low-level open/read/write — or not. Special devices would be created using mknod, again with the ...


1

From the perspective of the user, he has a primary group and 0 or more secondary groups. From the perspective of the group, it has 0 or more members. A group that is the primary group for one or more users can be both a secondary or primary group for other users.


1

You could create a script to do that backup and either run it automatically via cron or give his user the possibility to run only that script via sudo (if you want it secure, make sure he can only read and execute the script, if he could edit, he could easily get more rights.)


1

When changing a user's groups, the changes don't take effect until the next time the user logs in. So, you can either log out and log back in again or start a new login shell as gefalko: $ groups sys lp wheel optical scanner terdon terdon@oregano ~ $ sudo usermod -a -G www-data terdon terdon@oregano ~ $ groups sys lp wheel optical scanner terdon ## no ...


1

/opt is owned by root(admin user), you would need to change the owner to you, or just use the sudo command as below, sudo touch /opt/storage/file.txt Update If adding sudo is not fairly acceptable then change the ownership of folder, use chown sudo chown -R username:username /opt/storage/



Only top voted, non community-wiki answers of a minimum length are eligible