sudoer file how to give a particular user full access to only certain file

Question

I want to give a user full access to only certain files, can someone show me how to do that? For example, I want to modify the sudoer file to grant user access to only certain file. Thanks.

Answer 1

This is typically done using groups.

Ownership

Files have two owners: a user, and a group. For example:

$ ls -l file1.txt
-rw-rw-r-- 1 foo foo 6 Nov  9 15:37 file1.txt

Here, the user and group are both foo.

We can change file ownership using chown. Note that the link links to a manpage for Linux, but chown is pretty standard so it will probably work. When in doubt, consult your OS's manual (man chown).

For example, changing the group to bar:

$ chown :bar file1.txt
$ ls -l file1.txt
-rw-rw-r-- 1 foo bar 6 Nov  9 15:37 file1.txt

Note that the bar group needs to exist. Further below you'll see how to add new groups.

Permissions

The permissions are as follows:

-rw-rw-r--
Tuuugggooo

where T is the type; for normal files this is -, for directories d, for symbolic links l etc.
The uuu are the user permissions: rw-: read, write. The ggg group permissions are also rw-. Everyone else (ooo) gets r--, or, read-only access.

We can change the permissions using chmod (again, a Linux manpage, but chmod is pretty standard). If we wanted to remove the write permission for group bar from the file, we could do:

$ chmod g-w file1.txt
$ ls -l file1.txt
-rw-r--r-- 1 foo bar 6 Nov  9 15:37 file1.txt

Adding a new group

You could add a group specifically for managing access to some files. How this is done is platform dependent. For Linux, there is addgroup:

addgroup bar

For FreeBSD, there is pw. Check your Operating System manual for the correct command to use!

Adding users to groups

This again, is platform dependent. For FreeBSD, the pw command mentioned above handles this. For Linux, it is usermod.

Users typically have a primary (or initial) group, and secondary (or supplementary) groups. The primary group is used when new files are created.

For linux, adding (-a) user foo to the secondary (-G) bar group is done like this:

$ usermod -G bar -a foo

Now, the next time user foo logs in, his/her groups will be updated. Use the id command (Linux id / FreeBSD id: pretty standard) to inspect the group membership:

$ id
uid=1000(foo) gid=1000(foo) groups=1000(foo),1001(bar)

Answer 2

you can do it using access control lists:

1)first, check the ACL of that file:

getfacl PATH/files

the output will be something like this:

# file: PATH/file
# owner: root
# group: root
user::rw-
group::r--
other::r--

2)set the ACL of file in order to set full access permission for a specific user:

setfacl -m u:USERNAME:rwx PATH/file

3) now if you try "ls -l" command on your file, a plus(+) sign is added to the output:

-rw-rwxr--+ 1 root  root      0 Nov 10 20:12 file

4) get the ACL of file again to see the changes (Command is the same as step 1), the output will be like this:

# file: file
# owner: root
# group: root
user::rw-
user:USERNAME:rwx
group::r--
mask::rwx
other::r--

you can see that an exception is been declared for your specific user to have a permission to this file that is different from owner user, owner group and others permissions.

I hope you get your problem solved soon :)

Answer 3

For reference, check man sudo, man sudoers etc.

Here's a Linux-only example on how to configure a sudoers file to execute the SYSV Linux service script as root.

Edit/create a sudoers file for the user (I'll use theusername):

visudo /etc/sudoers.d/theusername

The format is

# <user list> <host list> = <operator list> <tag list> <command list>

You'll want to add this line:

theusername ALL = (root:root) NOPASSWD: /usr/sbin/service

It may be necessary to add the user theusername to the sudo group; see my other answer for details.

UPDATE

The OP (via comments) wants to execute this:

ProcessBuilder ntpProcessBuilder = new ProcessBuilder(
    "/bin/sh", "-c",
    "echo " + PUB_PASSWORD + 
    "| sudo -S bash -c \"cp -f " + ntp_conf_file_temp + " " + ntp_conf_file +
    "; service ntp reload\"" );

This will require to set up file permissions to be able to override the ntp_conf_file which we'll assume is owned by root. See the other answer for details. However, here's an alternative solution, using a script, placed in /etc/ntp-update.sh:

#!/bin/bash
/bin/cp /etc/managed-ntp/temp.conf /etc/ntpd/ntp.conf
/usr/sbin/service ntp reload

As you see, the file paths are harcoded for security.

To set it up, we edit the sudoers file for the user to give access to run this script as root:

theusername ALL = (root:root) NOPASSWD: /etc/ntp-update.sh

And create the directory:

mkdir /etc/managed-ntp
chmod 2775 /etc/managed-ntp
chown theusername:theusergroup /etc/managed-ntp

The 2 in 2775 is the setgid bit, which makes sure that files created in that directory are owned by the group of the directory. When running as root, this isn't really necessary, but may come in handy.

Now, the application can do this:

// Make sure you write ntp_conf_file_tmp in /etc/managed-ntp/temp.conf!    
ProcessBuilder ntpProcessBuilder = new ProcessBuilder(
    "/usr/bin/sudo", "/etc/ntp-update.sh"
);