Edit: The short question is: How do I give away access to files that my (non-priviledged) user currently owns. I would like to be unable to get access to them in any way. Please see the rest of the post for a more detailed description.

For some backups, I would like to copy files to a remote location. I would like these files to be secure, even in the case the local machine is compromised.

Initially, my plan was to chown the remote files to root as soon as they were written. This would not allow access from the local machine anymore, but in case of disaster would allow me to recover from the remote machine (assuming that one is not breached of course). It turns out however that chowning to another user is not allowed in Linux for security reasons. Is there another method to give away access to a file you currently own?

The remote machine is a raspberry pi running Raspbian Stretch and the local machine is running FreeNAS 11.0-U4. The local machine can ssh to the remote machine as a non-privileged user. I would like permissions of this user on the remote machine as limited as possible.

  • Please read our FAQ; this question can potentially be off-topic on 2 or 3 counts. – Rui F Ribeiro Feb 10 '18 at 17:04
  • 1
    @RuiFRibeiro: could you point out what the violation is specifically and where the question would be better asked? The topic list includes "Using or administering a *nix desktop or server" and "Shell scripting", which both feel like they include this question. – Octaviour Feb 10 '18 at 17:09
  • "Unclear what you are asking", "too broad", "Requests for learning materials (tutorials, how-tos etc.) are off topic. The only exception is questions about where to find official documentation (e.g. POSIX specifications).". You always do backups that the owner of the original files cannot touch. – Rui F Ribeiro Feb 10 '18 at 17:11
  • 3
    To answer the first two: I think this is a very specific question, but it might not be clear enough. I try to update my question to be more clear. Regarding the "request for learning materials (...)": I am looking for a way of solving this problem, so I guess you could qualify this as a how-to, but I fail to see how this is different than any question being asked. I haven't bee able to find the answer with a Google search or a search on SE if that's what you're afraid of. – Octaviour Feb 10 '18 at 17:17
  • 1
    That would be an egregious abuse of the "Requests for learning materials" close criterion, ironically when unix.meta.stackexchange.com/questions/3892 is right there on the Hot Meta Posts lists at the side of this page. – JdeBP Feb 10 '18 at 17:58

On a multi-user system with disk quotas, allowing unprivileged users to give away files to other users would allow the users to abuse each other's disk quotas.

It would be trivial for User A to create a directory that is accessible only by User A, then fill it with large files and give them all away to User B. Now User B's disk quota is exhausted by files that cannot be accessed by User B.

The ability of users to give away files (the SysV semantics for chown()) used to cause several kinds of security issues, and is now regarded in literature as broken behavior. For example, if you accidentally allow other users to write into your home directory, another user on the same system might want to give you some files/directories. Like <your_homedir>/.ssh/authorized_keys for example. Or <your_homedir>/.rhosts in the bad old days. Each of those could be used to allow access to your account, and you'd have difficult time proving it wasn't you.

On a Linux system, you might use sudo to allow the setting of the "immutable" attribute for the files, but not the command to clear it. This would be the example configuration line for /etc/sudoers:

Octaviour  ALL=(root) NOPASSWD: /usr/bin/chattr -R +i /your/backup/directory

You could then run sudo chattr -R +i /your/backup/directory but not the corresponding chattr -R -i command using your regular user account. The immutable bit can normally be set or cleared by root only.

(If Linux Capabilities are in use, a process with the CAP_LINUX_IMMUTABLE capability could do it. But it would be highly unusual for normal users to have that, and the use of capabilities themselves is pretty uncommon.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.