I've always been running chmod/chown commands as a sudo user. But today I wondered if I don't use sudo
, what permissions do I need to actually execute chmod/chown
command on a folder/file? I've tried googling the question, but nothing popped up that answers specifically this question.
On Linux:
chown: "Only a privileged process (Linux: one with the CAP_CHOWN
capability) may change the owner of a file." (Source: chown(2)) The easy way to be such a process is to be run by root
. See explain_chown
for help finding out why a particular chown
failed. See capabilities
for ways to give processes that capability other than running as root
.
chmod: The file's owner or root
can change permissions, plus other processes with the CAP_FOWNER
capability. (Source)
chgrp: "The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily." (chown(2))
-
1Linux started to implement capabilities around 2004, but the related POSIX proposal was withdrawn in 1997 already. If you are on a modern OS like Solaris, there is
PRIV_FILE_CHOWN
to chown all local files andPRIV_FILE_CHOWN_SELF
to chown local files owned by you. BTW: An OS that permits to chown remote files from NFS can be seen as a secutiry risk. On HP-UX, any regular user can chown his files and this is seen as a secutrity risk as well. – schily Sep 14 '15 at 10:17 -
P.S. the capability POSIX proposal was withdrawn because it only handles the privileges between a regular user and the historical root user. Solaris has twice as many fine grained privileges as Linux and permits to remove privileges like e.g. fork() and exec(). – schily Sep 14 '15 at 10:20
-
Note that on Linux, when not privileged, you can
chown
the files you own, but only the gid part (to any of the groups you're a member of). I can dochown stephane:other-group myfile
(orchown :other-group
) as long as I'm member ofother-group
. – Stéphane Chazelas Sep 14 '15 at 14:33 -
What about
chgrp
command? Can you please add explanation for that? – Max Koretskyi Sep 14 '15 at 15:33 -
@StéphaneChazelas, thanks, based on your answer I assume that an owner can successfuly run
chgrp
without being privileged user? – Max Koretskyi Sep 14 '15 at 15:44