I want to give a user full access to only certain files, can someone show me how to do that? For example, I want to modify the sudoer file to grant user access to only certain file. Thanks.
This is typically done using groups.
Files have two owners: a user, and a group. For example:
$ ls -l file1.txt -rw-rw-r-- 1 foo foo 6 Nov 9 15:37 file1.txt
Here, the user and group are both
We can change file ownership using
chown. Note that the link links to a manpage for Linux, but
chown is pretty standard so it will probably work. When in doubt, consult your OS's manual (
For example, changing the group to
$ chown :bar file1.txt $ ls -l file1.txt -rw-rw-r-- 1 foo bar 6 Nov 9 15:37 file1.txt
Note that the
bar group needs to exist. Further below you'll see how to add new groups.
The permissions are as follows:
T is the type; for normal files this is
-, for directories
d, for symbolic links
uuu are the user permissions:
rw-: read, write. The
ggg group permissions are also
rw-. Everyone else (
r--, or, read-only access.
We can change the permissions using chmod (again, a Linux manpage, but chmod is pretty standard). If we wanted to remove the write permission for group
bar from the file, we could do:
$ chmod g-w file1.txt $ ls -l file1.txt -rw-r--r-- 1 foo bar 6 Nov 9 15:37 file1.txt
Adding a new group
You could add a group specifically for managing access to some files. How this is done is platform dependent. For Linux, there is addgroup:
For FreeBSD, there is pw. Check your Operating System manual for the correct command to use!
Adding users to groups
This again, is platform dependent. For FreeBSD, the
pw command mentioned above handles this. For Linux, it is usermod.
Users typically have a primary (or initial) group, and secondary (or supplementary) groups. The primary group is used when new files are created.
For linux, adding (
foo to the secondary (
bar group is done like this:
$ usermod -G bar -a foo
$ id uid=1000(foo) gid=1000(foo) groups=1000(foo),1001(bar)
you can do it using access control lists:
1)first, check the ACL of that file:
the output will be something like this:
# file: PATH/file # owner: root # group: root user::rw- group::r-- other::r--
2)set the ACL of file in order to set full access permission for a specific user:
setfacl -m u:USERNAME:rwx PATH/file
3) now if you try "ls -l" command on your file, a plus(+) sign is added to the output:
-rw-rwxr--+ 1 root root 0 Nov 10 20:12 file
4) get the ACL of file again to see the changes (Command is the same as step 1), the output will be like this:
# file: file # owner: root # group: root user::rw- user:USERNAME:rwx group::r-- mask::rwx other::r--
you can see that an exception is been declared for your specific user to have a permission to this file that is different from owner user, owner group and others permissions.
I hope you get your problem solved soon :)
For reference, check
man sudoers etc.
Here's a Linux-only example on how to configure a sudoers file to execute the SYSV Linux service script as root.
Edit/create a sudoers file for the user (I'll use
The format is
# <user list> <host list> = <operator list> <tag list> <command list>
You'll want to add this line:
theusername ALL = (root:root) NOPASSWD: /usr/sbin/service
It may be necessary to add the user
theusername to the
sudo group; see my other answer for details.
The OP (via comments) wants to execute this:
ProcessBuilder ntpProcessBuilder = new ProcessBuilder( "/bin/sh", "-c", "echo " + PUB_PASSWORD + "| sudo -S bash -c \"cp -f " + ntp_conf_file_temp + " " + ntp_conf_file + "; service ntp reload\"" );
This will require to set up file permissions to be able to override the
ntp_conf_file which we'll assume is owned by root. See the other answer for details.
However, here's an alternative solution, using a script, placed in
#!/bin/bash /bin/cp /etc/managed-ntp/temp.conf /etc/ntpd/ntp.conf /usr/sbin/service ntp reload
As you see, the file paths are harcoded for security.
To set it up, we edit the sudoers file for the user to give access to run this script as root:
theusername ALL = (root:root) NOPASSWD: /etc/ntp-update.sh
And create the directory:
mkdir /etc/managed-ntp chmod 2775 /etc/managed-ntp chown theusername:theusergroup /etc/managed-ntp
2775 is the
setgid bit, which makes sure that files created in that directory are owned by the group of the directory. When running as root, this isn't really necessary, but may come in handy.
Now, the application can do this:
// Make sure you write ntp_conf_file_tmp in /etc/managed-ntp/temp.conf! ProcessBuilder ntpProcessBuilder = new ProcessBuilder( "/usr/bin/sudo", "/etc/ntp-update.sh" );