I want to give a user full access to only certain files, can someone show me how to do that? For example, I want to modify the sudoer file to grant user access to only certain file. Thanks.
-
1This is also off topic, but you shouldn't using sudo's file for this, but actually chown and chmod/ whatever works on your system. Flagged to be migrated to superuser – Sirens Nov 9 '15 at 1:52
This is typically done using groups.
Ownership
Files have two owners: a user, and a group. For example:
$ ls -l file1.txt
-rw-rw-r-- 1 foo foo 6 Nov 9 15:37 file1.txt
Here, the user and group are both foo
.
We can change file ownership using
chown. Note that the link links to a manpage for Linux, but chown
is pretty standard so it will probably work. When in doubt, consult your OS's manual (man chown
).
For example, changing the group to bar
:
$ chown :bar file1.txt
$ ls -l file1.txt
-rw-rw-r-- 1 foo bar 6 Nov 9 15:37 file1.txt
Note that the bar
group needs to exist. Further below you'll see how to add new groups.
Permissions
The permissions are as follows:
-rw-rw-r--
Tuuugggooo
where T
is the type; for normal files this is -
, for directories d
, for symbolic links l
etc.
The uuu
are the user permissions: rw-
: read, write. The ggg
group permissions are also rw-
. Everyone else (ooo
) gets r--
, or, read-only access.
We can change the permissions using chmod (again, a Linux manpage, but chmod is pretty standard). If we wanted to remove the write permission for group bar
from the file, we could do:
$ chmod g-w file1.txt
$ ls -l file1.txt
-rw-r--r-- 1 foo bar 6 Nov 9 15:37 file1.txt
Adding a new group
You could add a group specifically for managing access to some files. How this is done is platform dependent. For Linux, there is addgroup:
addgroup bar
For FreeBSD, there is pw. Check your Operating System manual for the correct command to use!
Adding users to groups
This again, is platform dependent. For FreeBSD, the pw
command mentioned above handles this. For Linux, it is usermod.
Users typically have a primary (or initial) group, and secondary (or supplementary) groups. The primary group is used when new files are created.
For linux, adding (-a
) user foo
to the secondary (-G
) bar
group is done like this:
$ usermod -G bar -a foo
Now, the next time user foo
logs in, his/her groups will be updated. Use the id
command (Linux id / FreeBSD id: pretty standard) to inspect the group membership:
$ id
uid=1000(foo) gid=1000(foo) groups=1000(foo),1001(bar)
-
Note that
addgroup
is a common Linux utility, but is not universal amongst other Unix-style operating systems. For example, the FreeBSD method to add a group would bepw groupadd special
, and you'd usepw usermod username -G special
to add that group to a user. The question doesn't mention any particular operating system, so it's best to provide portable solutions, or qualify your answer if it's limited to just one OS. – ghoti Nov 9 '15 at 4:02 -
-
You could also use ACL (acces control list) for adding extra permission on file. It could be usefull when you can't change the group of a file. see setfacl and getfacl command. Morother, be carefull with this command because ACL can be disabled on filesystem and could lead to security issue if used to remove permission to specific user. – alexises Nov 9 '15 at 15:19
-
Actually let me clarify, it's not the files that needs permission per se, but the commands that are performed on the file, e.g. cp, sed, etc. This will keep me from having to do something like this: ProcessBuilder ntpProcessBuilder = new ProcessBuilder( "/bin/sh", "-c", "echo " + PUB_PASSWORD + "| sudo -S bash -c \"cp -f " + ntp_conf_file_temp + " " + ntp_conf_file + "; service ntp reload\"" ); I don't want to hardcode the password. Thanks. – user270811 Nov 9 '15 at 20:15
-
Added another answer dealing with the sudo part. You'll need to run as root so you want to make it as tight as possible. The file copy would still need a group approach from this answer; you don't want to give your (presumably Java) program root access to
cp
, for obvious reasons. I'll update the other answer shortly with another approach. – Kenney Nov 9 '15 at 20:49
you can do it using access control lists:
1)first, check the ACL of that file:
getfacl PATH/files
the output will be something like this:
# file: PATH/file
# owner: root
# group: root
user::rw-
group::r--
other::r--
2)set the ACL of file in order to set full access permission for a specific user:
setfacl -m u:USERNAME:rwx PATH/file
3) now if you try "ls -l" command on your file, a plus(+) sign is added to the output:
-rw-rwxr--+ 1 root root 0 Nov 10 20:12 file
4) get the ACL of file again to see the changes (Command is the same as step 1), the output will be like this:
# file: file
# owner: root
# group: root
user::rw-
user:USERNAME:rwx
group::r--
mask::rwx
other::r--
you can see that an exception is been declared for your specific user to have a permission to this file that is different from owner user, owner group and others permissions.
I hope you get your problem solved soon :)
For reference, check man sudo
, man sudoers
etc.
Here's a Linux-only example on how to configure a sudoers file to execute the SYSV Linux service script as root.
Edit/create a sudoers file for the user (I'll use theusername
):
visudo /etc/sudoers.d/theusername
The format is
# <user list> <host list> = <operator list> <tag list> <command list>
You'll want to add this line:
theusername ALL = (root:root) NOPASSWD: /usr/sbin/service
It may be necessary to add the user theusername
to the sudo
group; see my other answer for details.
UPDATE
The OP (via comments) wants to execute this:
ProcessBuilder ntpProcessBuilder = new ProcessBuilder(
"/bin/sh", "-c",
"echo " + PUB_PASSWORD +
"| sudo -S bash -c \"cp -f " + ntp_conf_file_temp + " " + ntp_conf_file +
"; service ntp reload\"" );
This will require to set up file permissions to be able to override the ntp_conf_file
which we'll assume is owned by root. See the other answer for details.
However, here's an alternative solution, using a script, placed in /etc/ntp-update.sh
:
#!/bin/bash
/bin/cp /etc/managed-ntp/temp.conf /etc/ntpd/ntp.conf
/usr/sbin/service ntp reload
As you see, the file paths are harcoded for security.
To set it up, we edit the sudoers file for the user to give access to run this script as root:
theusername ALL = (root:root) NOPASSWD: /etc/ntp-update.sh
And create the directory:
mkdir /etc/managed-ntp
chmod 2775 /etc/managed-ntp
chown theusername:theusergroup /etc/managed-ntp
The 2
in 2775
is the setgid
bit, which makes sure that files created in that directory are owned by the group of the directory. When running as root, this isn't really necessary, but may come in handy.
Now, the application can do this:
// Make sure you write ntp_conf_file_tmp in /etc/managed-ntp/temp.conf!
ProcessBuilder ntpProcessBuilder = new ProcessBuilder(
"/usr/bin/sudo", "/etc/ntp-update.sh"
);
-
I read somewhere that you should create an empty file in sudoer.d, but rather create it else where and then copy it there. Do you have a good example of how to modify the file in sudoer.d folder in shell script (I am assuming the optimal way is to modify a sudoers.d file and not sudoers file? Also, can you create groups within the sudoers.d file directly as opposed to creating a group outside of it and then reference it inside the file? – user270811 Nov 9 '15 at 22:31
-
Also, does ntp-update.sh have to use sudo and therefore include password? – user270811 Nov 10 '15 at 1:13
-
@user270811 it's like I said: as root,
visudo -f /etc/sudoers.d/someusername
. Seeman visudo
on your system. You should not access that file any other way. You can only reference groups in a sudoers file; you'll have to create them withaddgroup
. And no,ntp-update.sh
does not need a password: the purpose of specifyingNOPASSWD
in the sudoers file is that you don't have to. You call/etc/ntp-update.sh
usingsudo
;/etc/ntp-update.sh
itself does not use sudo. Try calling it on the commandline first, you'll understand:sudo /etc/ntp-update.sh
. – Kenney Nov 10 '15 at 3:18