I'm writing a set of scripts to provision game servers.
I have each game server being installed as a separate user, so that they're all isolated and can't access each other's files.
The daemon/server which handles the provisioning runs as an unprivileged user, with sudo permission to create users.
I'm now developing a feature that requires the daemon to be able to edit files on behalf of users after the servers are provisioned.
I was thinking of adding the daemon to a group like "admin", setting the group on all users files to "admin" with group permissions so that the daemon can read and write their files - though leaving the individual users out of the "admin" group so they can't read each others files.
This works on first install, and I can set the setgid bit to ensure that new files and folder inherit the "admin" group. However, it's possible for the users to "chgrp" to their own group, which breaks this system. The daemon can no longer access the files, and even the users cannot revert the group back to "admin" because they do not belong to that group.
Is there a way:
- To prevent the game server users from changing the group of their files to anything other than "admin", so the above will work; or
- Is there a better way to achieve what I'm trying to achieve here?