The preconditions are somewhat complex, so here is the context:
- There is a program, that is launched through a shell script;
- The shell script launches the program through a .jar file;
- I want this program to store its cache in a
/var/opt/
subfolder, say/var/opt/program/
; - The cache content should not be accessible directly, only through the program
- The program should be available for all local users in a system
The main idea I came up with is to create a group that has all required permissions to read and edit content of the cache folder. I don't want to add users to the group manually, so was looking for alternative options. If I understand it right, the setgid
bit should suit me perfectly. My understanding as follows:
- A folder with the
setgid
bit set force all its content to have the same owner group, as the folder has and force all its subfolders to follow the same rules. In the meantime it doesn't provide any extra permissions for the those not included in the folder owner group, that is, folder with mask drwxrws--x does not allow others to edit and read its content. - A program with the
setgid
bit set always run on behalf of the owner group, allowing users to perform actions respecting group permissions.
My steps as follows:
- I created a group mygroup;
- I created a folder
/var/opt/program/
and set its owner group to mygroup; - I set
setgid
bit for the folder - I set the program shells script owner group to mygroup;
- I set
setgid
bit for the shell script
The problem is that the program is not able to create and edit files in the cache folder being launched by a user without root permissions. Any advice will be appreciated.
UPD Environment:
OS: Ubuntu 16.04.2 LTS