I would like to be able to run a command, passing in parameters to bash or similar, such that this command is not allowed to write to a particular path, overriding the user's other privs.


root> /bin/bash -protect /folder/to/protect mycommand.sh

In this example, the root user can obviously do what it wants, but while I test a new script I'm writing, I would like to protect a folder, as if the folder was read only for that user.

Is there a way to do this without adding a new user and adjusting that user's privs accordingly? It doesn't have to be in bash by the way, I don't mind the approach - as long as I can protect folders without adding a new user I don't mind!

  • Are we talking about subfolders too? What abouch chmod u-w folder, what about a backup, which you restore later? – user unknown Jul 13 '11 at 17:52
  • 1
    By the way, they're called directories in the unix world. – Gilles Jul 13 '11 at 22:27

Unix's security is built on permissions for users and groups. If you want to make a directory read-only for a command, you need to run it as a user who isn't allowed to write to that directory. Or there's a heavier-handed approach, which is to run the command in a virtual machine.

You may find bindfs useful. Bindfs is a stacked filesystem, that is, it creates an alternate view of a part of the directory tree. In particular, you can create a read-only view, or a view with different permissions. Bindfs can't make /folder/to/protect read-only, but it can create a read-only view of that directory /read/only/view; you need to find some other means (such as permissions) of preventing the command from writing in `/folder/to/protect.

bindfs --perms=a-w /folder/to/protect /read/only/view
  • Shouldn't your last sentence read "you need to find some other means (such as permissions) of preventing the command from writing in `/read/only/view"? – Rich Jul 18 '11 at 8:15
  • @Rich No, I don't think so, why should it? The read-only view is read-only to everyone. It's the folder to protect that you still need to protect, independently of the read-only view. – Gilles Jul 18 '11 at 9:09

You could write a shared library which implemented a wrapper around open which performed the additional security check(s) you want. The program you write can then use can then use LD_PRELOAD to load your shared library when invoking the program and override the system's open.

You may need to override other system calls to ensure there is not an alternative way for the program to achieve what it's trying to do.

  • This only works if the program is cooperative (what if it removes your wrapper? what if it has statically linked a copy of open? what if it calls the syscall directly?), and you're thorough enough (what if the program unlinks some files, or renames them to a different directory, and so on). – Gilles Jul 14 '11 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.