2

I have some directories with quite permissive permissions, which get cluttered up with files (scripts) created by lots of different users. I try to encourage people to create their own sub-directory and add their files in there, but some do not, leaving the root scripts directory full of things others are not interested in.

Since I have only had limited success in persuading people from creating files in the root directory, but we still need all users to be able to access any of the scripts, I was hoping that we might be able to enforce the policy of scripts being written into a subdirectory using permissions or access control lists.

So, is it possible to allow users to only create directories in the root scripts folder, but allow them to create scripts only in those sub-directories?

1 Answer 1

2

It's not a great solution, but:

  • make the directory writable only by you, or some designated user or pseudo-user, or, perhaps better yet, a group (that your users are not members of),
  • carefully write a wrapper for mkdir, and install it setuid or setgid.


  • If you choose the group / setgid option, it could be as simple as
    mkdir("root_scripts/<user's folder name>", 0755);

    And, if you don't care about making the folder owned by the user who created it, that's all you need to do if the program is setuid.  Otherwise,
  • If you make the program setuid root, be very very carefully to do a million checks for inappropriate usage, and then
    mkdir("root_scripts/<user's folder name>", 0755);
    chown("root_scripts/<user's folder name>", <user's uid>, <user's gid>);
  • If you make the program setuid to a non-root user, create a world-writable subdirectory in (or somewhere under) your root_scripts directory, and do something like
    euid = geteuid();
    ruid = getruid();
    seteuid(ruid);          // Person who's running the program
    mkdir("root_scripts/.writable_subdir/<user's folder name>", 0755);
    seteuid(euid);          // Owner of the program and the top-level directory
    rename("root_scripts/.writable_subdir/<user's folder name>, "root_scripts/<user's folder name>");
4
  • If the wrapper is setgid (and that's what it should be), the directory will be owned by the calling user. Apr 14, 2015 at 23:10
  • @Gilles: Yes, I know.  I see now that what I wrote wasn’t crystal clear.  Let me rephrase it: “If you choose setgid, it could be as simple as mkdir(…);. (period)  If the program is setuid, then that (mkdir(…);) is sufficient, unless you care about the ownership of the folder; in that case, you need to take extra steps to establish correct ownership.  …” Apr 15, 2015 at 2:54
  • Thanks Scott, setuid scripts are not an option here unfortunately, but at least this helps me confirm that what I want to do isn't possible.
    – Mark Booth
    Apr 20, 2015 at 12:57
  • First of all, I said it could be setuid or setgid, and, as @Gilles points out, setgid is better.  Secondly, are setgid programs off the table, or only setgid scripts?  Because I wasn't suggesting a script; I was suggesting a program, in a language such as C, that can be compiled to a binary executable. Apr 20, 2015 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.