On our server, there are multiple (currently two, expected three or four) users allowed to deploy a new version of our application. This process consists of downloading a few files from a trusted source git repository and starting the application (a non-privileged process).
This all gets done using a single script and takes a couple of seconds. Unless another user has left there files or directories with wrong permissions or group.
Then the deployment fails and we execute
sudo chgrp -R sudo /our/root/directory sudo chmod -R g=u,o-rwx /our/root/directory &&
I'd like to allow us to do this without the need to enter a password.
I know that
setuid doesn't work on a shell script (for a good reason). I thought of using a setuid perl script, but it's no more supported. I could write a C wrapper and a script, but having two files sounds neither comfortable nor secure. I could write the whole stuff in C using system calls, but it'd take me ages.
So I'm asking: What's a simple and secure way to achieve this? Writing some short C code is OK.
It's Ubuntu 16.04 in case it matters.
(*) We're using the group
sudo and permission
rw-rw---- for the whole tree.