Prevent users from changing group of their own files

Question

I'm writing a set of scripts to provision game servers.

I have each game server being installed as a separate user, so that they're all isolated and can't access each other's files.

The daemon/server which handles the provisioning runs as an unprivileged user, with sudo permission to create users.

I'm now developing a feature that requires the daemon to be able to edit files on behalf of users after the servers are provisioned.

I was thinking of adding the daemon to a group like "admin", setting the group on all users files to "admin" with group permissions so that the daemon can read and write their files - though leaving the individual users out of the "admin" group so they can't read each others files.

This works on first install, and I can set the setgid bit to ensure that new files and folder inherit the "admin" group. However, it's possible for the users to "chgrp" to their own group, which breaks this system. The daemon can no longer access the files, and even the users cannot revert the group back to "admin" because they do not belong to that group.

Is there a way:

1. To prevent the game server users from changing the group of their files to anything other than "admin", so the above will work; or
2. Is there a better way to achieve what I'm trying to achieve here?

Answer 1

Ownership access includes the access to set the group-ID, permissions bits, and ACLs; so there is nothing that you can do to stop the owners of a file from setting this stuff.

Of course, hidden in that sentence is the seed of two different approaches:

1. Do not grant ownership access in the first place. Do not make the user accounts the owners of the files. Instead, use setfacl to grant the individual user accounts rwx (or whatever) access in an ACL. Make them owned by some other account, assigned a group that the accounts are not part of, and not world-accessible. The disadvantages here are things like disc quotas.
2. Use a form of access control that the owner can turn back on. Make the individual user accounts the owners but use setfacl to grant the dæmon account rw- (or whatever) access in an ACL. The disadvantage here is that the user accounts can turn access off in the first place.

Evaluate the trade-offs according to need. Use default ACLs in the parent directory if you want to automatically set these ACLs on all created files.

Further reading

• Give user access to folder without changing ownership?