6

I want to give a user full access to only certain files, can someone show me how to do that? For example, I want to modify the sudoer file to grant user access to only certain file. Thanks.

  • 1
    This is also off topic, but you shouldn't using sudo's file for this, but actually chown and chmod/ whatever works on your system. Flagged to be migrated to superuser – Sirens Nov 9 '15 at 1:52
4

This is typically done using groups.

Ownership

Files have two owners: a user, and a group. For example:

$ ls -l file1.txt
-rw-rw-r-- 1 foo foo 6 Nov  9 15:37 file1.txt

Here, the user and group are both foo.

We can change file ownership using chown. Note that the link links to a manpage for Linux, but chown is pretty standard so it will probably work. When in doubt, consult your OS's manual (man chown).

For example, changing the group to bar:

$ chown :bar file1.txt
$ ls -l file1.txt
-rw-rw-r-- 1 foo bar 6 Nov  9 15:37 file1.txt

Note that the bar group needs to exist. Further below you'll see how to add new groups.

Permissions

The permissions are as follows:

-rw-rw-r--
Tuuugggooo

where T is the type; for normal files this is -, for directories d, for symbolic links l etc.
The uuu are the user permissions: rw-: read, write. The ggg group permissions are also rw-. Everyone else (ooo) gets r--, or, read-only access.

We can change the permissions using chmod (again, a Linux manpage, but chmod is pretty standard). If we wanted to remove the write permission for group bar from the file, we could do:

$ chmod g-w file1.txt
$ ls -l file1.txt
-rw-r--r-- 1 foo bar 6 Nov  9 15:37 file1.txt

Adding a new group

You could add a group specifically for managing access to some files. How this is done is platform dependent. For Linux, there is addgroup:

addgroup bar

For FreeBSD, there is pw. Check your Operating System manual for the correct command to use!

Adding users to groups

This again, is platform dependent. For FreeBSD, the pw command mentioned above handles this. For Linux, it is usermod.

Users typically have a primary (or initial) group, and secondary (or supplementary) groups. The primary group is used when new files are created.

For linux, adding (-a) user foo to the secondary (-G) bar group is done like this:

$ usermod -G bar -a foo

Now, the next time user foo logs in, his/her groups will be updated. Use the id command (Linux id / FreeBSD id: pretty standard) to inspect the group membership:

$ id
uid=1000(foo) gid=1000(foo) groups=1000(foo),1001(bar)
  • Note that addgroup is a common Linux utility, but is not universal amongst other Unix-style operating systems. For example, the FreeBSD method to add a group would be pw groupadd special, and you'd use pw usermod username -G special to add that group to a user. The question doesn't mention any particular operating system, so it's best to provide portable solutions, or qualify your answer if it's limited to just one OS. – ghoti Nov 9 '15 at 4:02
  • @ghoti Thanks for the feedback, I updated the answer! – Kenney Nov 9 '15 at 15:15
  • You could also use ACL (acces control list) for adding extra permission on file. It could be usefull when you can't change the group of a file. see setfacl and getfacl command. Morother, be carefull with this command because ACL can be disabled on filesystem and could lead to security issue if used to remove permission to specific user. – alexises Nov 9 '15 at 15:19
  • Actually let me clarify, it's not the files that needs permission per se, but the commands that are performed on the file, e.g. cp, sed, etc. This will keep me from having to do something like this: ProcessBuilder ntpProcessBuilder = new ProcessBuilder( "/bin/sh", "-c", "echo " + PUB_PASSWORD + "| sudo -S bash -c \"cp -f " + ntp_conf_file_temp + " " + ntp_conf_file + "; service ntp reload\"" ); I don't want to hardcode the password. Thanks. – user270811 Nov 9 '15 at 20:15
  • Added another answer dealing with the sudo part. You'll need to run as root so you want to make it as tight as possible. The file copy would still need a group approach from this answer; you don't want to give your (presumably Java) program root access to cp, for obvious reasons. I'll update the other answer shortly with another approach. – Kenney Nov 9 '15 at 20:49
2

you can do it using access control lists:

1)first, check the ACL of that file:

getfacl PATH/files

the output will be something like this:

# file: PATH/file
# owner: root
# group: root
user::rw-
group::r--
other::r--

2)set the ACL of file in order to set full access permission for a specific user:

setfacl -m u:USERNAME:rwx PATH/file

3) now if you try "ls -l" command on your file, a plus(+) sign is added to the output:

-rw-rwxr--+ 1 root  root      0 Nov 10 20:12 file

4) get the ACL of file again to see the changes (Command is the same as step 1), the output will be like this:

# file: file
# owner: root
# group: root
user::rw-
user:USERNAME:rwx
group::r--
mask::rwx
other::r--

you can see that an exception is been declared for your specific user to have a permission to this file that is different from owner user, owner group and others permissions.

I hope you get your problem solved soon :)

1

For reference, check man sudo, man sudoers etc.

Here's a Linux-only example on how to configure a sudoers file to execute the SYSV Linux service script as root.

Edit/create a sudoers file for the user (I'll use theusername):

visudo /etc/sudoers.d/theusername

The format is

# <user list> <host list> = <operator list> <tag list> <command list>

You'll want to add this line:

theusername ALL = (root:root) NOPASSWD: /usr/sbin/service

It may be necessary to add the user theusername to the sudo group; see my other answer for details.

UPDATE

The OP (via comments) wants to execute this:

ProcessBuilder ntpProcessBuilder = new ProcessBuilder(
    "/bin/sh", "-c",
    "echo " + PUB_PASSWORD + 
    "| sudo -S bash -c \"cp -f " + ntp_conf_file_temp + " " + ntp_conf_file +
    "; service ntp reload\"" );

This will require to set up file permissions to be able to override the ntp_conf_file which we'll assume is owned by root. See the other answer for details. However, here's an alternative solution, using a script, placed in /etc/ntp-update.sh:

#!/bin/bash
/bin/cp /etc/managed-ntp/temp.conf /etc/ntpd/ntp.conf
/usr/sbin/service ntp reload

As you see, the file paths are harcoded for security.

To set it up, we edit the sudoers file for the user to give access to run this script as root:

theusername ALL = (root:root) NOPASSWD: /etc/ntp-update.sh

And create the directory:

mkdir /etc/managed-ntp
chmod 2775 /etc/managed-ntp
chown theusername:theusergroup /etc/managed-ntp

The 2 in 2775 is the setgid bit, which makes sure that files created in that directory are owned by the group of the directory. When running as root, this isn't really necessary, but may come in handy.

Now, the application can do this:

// Make sure you write ntp_conf_file_tmp in /etc/managed-ntp/temp.conf!    
ProcessBuilder ntpProcessBuilder = new ProcessBuilder(
    "/usr/bin/sudo", "/etc/ntp-update.sh"
);
  • I read somewhere that you should create an empty file in sudoer.d, but rather create it else where and then copy it there. Do you have a good example of how to modify the file in sudoer.d folder in shell script (I am assuming the optimal way is to modify a sudoers.d file and not sudoers file? Also, can you create groups within the sudoers.d file directly as opposed to creating a group outside of it and then reference it inside the file? – user270811 Nov 9 '15 at 22:31
  • Also, does ntp-update.sh have to use sudo and therefore include password? – user270811 Nov 10 '15 at 1:13
  • @user270811 it's like I said: as root, visudo -f /etc/sudoers.d/someusername. See man visudo on your system. You should not access that file any other way. You can only reference groups in a sudoers file; you'll have to create them with addgroup. And no, ntp-update.sh does not need a password: the purpose of specifying NOPASSWD in the sudoers file is that you don't have to. You call /etc/ntp-update.sh using sudo; /etc/ntp-update.sh itself does not use sudo. Try calling it on the commandline first, you'll understand: sudo /etc/ntp-update.sh. – Kenney Nov 10 '15 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.