0

I have been wondering about the following thing:

Consider Pc A. Pc A has n users. There is a folder with one file per user. There is some sensitive information for each usere there, so you don't want anyone except the owner of the file to be able to read/write from it. (not even the sudo of the other users)

What is the correct approach to achieve that ? What I have thought of is to set chmod to 700

4
  • What exactly do you mean by "not even the sudo of the other users"? Do you want this file to be unreadable by root, too? Commented Jul 2, 2014 at 21:43
  • yes, I want just the user who has created it to be able to edit it.
    – Bloodcount
    Commented Jul 2, 2014 at 21:44
  • 2
    Well, no matter what you do you can't prevent a root user from reading or modifying the file. If your users have access to unrestricted sudo, there's nothing you can do to prevent their access. Commented Jul 2, 2014 at 21:45
  • Perhaps what you really need is to take away sudo access for the other users?
    – depquid
    Commented Jul 2, 2014 at 21:53

1 Answer 1

1

There is a folder with one file per user.

What are the permissions on that folder? If user Alice can write to that directory, she can mv bob bob.old and echo alice >bob - she can't read the old bob file, or remove it, but she can move it aside, and create a new file named bob with contents that she controls.

Assuming that the folder that contains all of these files is writable only by a superuser, though, there's nothing generally wrong with this approach. And it can be managed even for directories that are writable by multiple users - like /tmp - by setting the "sticky bit" on the directory.

And, wait: What do you mean by this?

you don't want anyone except the owner of the file to be able to read/write from it. (not even the sudo of the other users)

By "the sudo of other users" do you mean that user alice does sudo cat /path/to/bob? There's nothing that you can do to prevent that. If you let users become root using sudo, you can't prevent them from doing anything - the root user has full permissions to everything.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .