9

I've always been running chmod/chown commands as a sudo user. But today I wondered if I don't use sudo, what permissions do I need to actually execute chmod/chown command on a folder/file? I've tried googling the question, but nothing popped up that answers specifically this question.

|improve this question

migrated from serverfault.com Sep 14 '15 at 9:55

This question came from our site for system and network administrators.

16

On Linux:

chown: "Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file." (Source: chown(2)) The easy way to be such a process is to be run by root. See explain_chown for help finding out why a particular chown failed. See capabilities for ways to give processes that capability other than running as root.

chmod: The file's owner or root can change permissions, plus other processes with the CAP_FOWNER capability. (Source)

chgrp: "The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily." (chown(2))

|improve this answer
  • 1
    Linux started to implement capabilities around 2004, but the related POSIX proposal was withdrawn in 1997 already. If you are on a modern OS like Solaris, there is PRIV_FILE_CHOWN to chown all local files and PRIV_FILE_CHOWN_SELFto chown local files owned by you. BTW: An OS that permits to chown remote files from NFS can be seen as a secutiry risk. On HP-UX, any regular user can chown his files and this is seen as a secutrity risk as well. – schily Sep 14 '15 at 10:17
  • P.S. the capability POSIX proposal was withdrawn because it only handles the privileges between a regular user and the historical root user. Solaris has twice as many fine grained privileges as Linux and permits to remove privileges like e.g. fork() and exec(). – schily Sep 14 '15 at 10:20
  • Note that on Linux, when not privileged, you can chown the files you own, but only the gid part (to any of the groups you're a member of). I can do chown stephane:other-group myfile (or chown :other-group) as long as I'm member of other-group. – Stéphane Chazelas Sep 14 '15 at 14:33
  • What about chgrp command? Can you please add explanation for that? – Maxim Koretskyi Sep 14 '15 at 15:33
  • @StéphaneChazelas, thanks, based on your answer I assume that an owner can successfuly run chgrp without being privileged user? – Maxim Koretskyi Sep 14 '15 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.