I've always been running chmod/chown commands as a sudo user. But today I wondered if I don't use sudo
, what permissions do I need to actually execute chmod/chown
command on a folder/file? I've tried googling the question, but nothing popped up that answers specifically this question.
1 Answer
On Linux:
chown: "Only a privileged process (Linux: one with the CAP_CHOWN
capability) may change the owner of a file." (Source: chown(2)) The easy way to be such a process is to be run by root
. See explain_chown
for help finding out why a particular chown
failed. See capabilities
for ways to give processes that capability other than running as root
.
chmod: The file's owner or root
can change permissions, plus other processes with the CAP_FOWNER
capability. (Source)
chgrp: "The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily." (chown(2))
-
1Linux started to implement capabilities around 2004, but the related POSIX proposal was withdrawn in 1997 already. If you are on a modern OS like Solaris, there is
PRIV_FILE_CHOWN
to chown all local files andPRIV_FILE_CHOWN_SELF
to chown local files owned by you. BTW: An OS that permits to chown remote files from NFS can be seen as a secutiry risk. On HP-UX, any regular user can chown his files and this is seen as a secutrity risk as well.– schilySep 14, 2015 at 10:17 -
P.S. the capability POSIX proposal was withdrawn because it only handles the privileges between a regular user and the historical root user. Solaris has twice as many fine grained privileges as Linux and permits to remove privileges like e.g. fork() and exec().– schilySep 14, 2015 at 10:20
-
Note that on Linux, when not privileged, you can
chown
the files you own, but only the gid part (to any of the groups you're a member of). I can dochown stephane:other-group myfile
(orchown :other-group
) as long as I'm member ofother-group
. Sep 14, 2015 at 14:33 -
What about
chgrp
command? Can you please add explanation for that? Sep 14, 2015 at 15:33 -
@StéphaneChazelas, thanks, based on your answer I assume that an owner can successfuly run
chgrp
without being privileged user? Sep 14, 2015 at 15:44