We're developing an application that makes it possible to change the file permissions of some files that users have created.
So e.g. the user "Bob" creates a file in /srv/share/ then bob is the owner of the file he created and only he and root are able to set the appropriate permissions.
Now we don't like to run our application as root, because of some security concerns. So is it possible in Linux to say that a user "Application" is able to modify the permissions of files that another user has createdin the directory /srv/share? And only there? Otherwise the user "Application" would be able to change some system files and is able to make himself root, which isn't intended of course.
Let's say Bob creates a file "test.txt" in /srv/share/ The permissions would look like this: UserOwner: Bob GroupOwner: AGroupName Permissions: 755
Now let's say our application would like to change the permission of the file "test.txt" to 770. That's only possible when the application runs as root. I know that it's possible to change the umask or use default ACLs so the default permissions would change of new created files, but we have another use case which requires a dynamical change of permissions of specific files.
Currently we're running a Debian Stretch 9.3 with Kernel 4.9.0-6.
So does anybody have an idea how to do this? Or is it simply not possible?
Edit:// To make some things clear. We don't want to allow a group to access the file of Bob or write to the directory. We want to change the file permissions, which is only allowed for the user itself (Bob) and root from another non root user, only in this specific directory.