17

I've always been running chmod/chown commands as a sudo user. But today I wondered if I don't use sudo, what permissions do I need to actually execute chmod/chown command on a folder/file? I've tried googling the question, but nothing popped up that answers specifically this question.

Improve this question

1 Answer 1

Reset to default
23

On Linux:

chown: "Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file." (Source: chown(2)) The easy way to be such a process is to be run by root. See explain_chown for help finding out why a particular chown failed. See capabilities for ways to give processes that capability other than running as root.

chmod: The file's owner or root can change permissions, plus other processes with the CAP_FOWNER capability. (Source)

chgrp: "The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily." (chown(2))

Improve this answer
6
  • 1
    Linux started to implement capabilities around 2004, but the related POSIX proposal was withdrawn in 1997 already. If you are on a modern OS like Solaris, there is PRIV_FILE_CHOWN to chown all local files and PRIV_FILE_CHOWN_SELFto chown local files owned by you. BTW: An OS that permits to chown remote files from NFS can be seen as a secutiry risk. On HP-UX, any regular user can chown his files and this is seen as a secutrity risk as well.
    – schily
    Sep 14, 2015 at 10:17
  • P.S. the capability POSIX proposal was withdrawn because it only handles the privileges between a regular user and the historical root user. Solaris has twice as many fine grained privileges as Linux and permits to remove privileges like e.g. fork() and exec().
    – schily
    Sep 14, 2015 at 10:20
  • Note that on Linux, when not privileged, you can chown the files you own, but only the gid part (to any of the groups you're a member of). I can do chown stephane:other-group myfile (or chown :other-group) as long as I'm member of other-group.
    – Stéphane Chazelas
    Sep 14, 2015 at 14:33
  • What about chgrp command? Can you please add explanation for that?
    – Max Koretskyi
    Sep 14, 2015 at 15:33
  • @StéphaneChazelas, thanks, based on your answer I assume that an owner can successfuly run chgrp without being privileged user?
    – Max Koretskyi
    Sep 14, 2015 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.