We're developing an application that makes it possible to change the file permissions of some files that users have created.

So e.g. the user "Bob" creates a file in /srv/share/ then bob is the owner of the file he created and only he and root are able to set the appropriate permissions.

Now we don't like to run our application as root, because of some security concerns. So is it possible in Linux to say that a user "Application" is able to modify the permissions of files that another user has createdin the directory /srv/share? And only there? Otherwise the user "Application" would be able to change some system files and is able to make himself root, which isn't intended of course.

Let's say Bob creates a file "test.txt" in /srv/share/ The permissions would look like this: UserOwner: Bob GroupOwner: AGroupName Permissions: 755

Now let's say our application would like to change the permission of the file "test.txt" to 770. That's only possible when the application runs as root. I know that it's possible to change the umask or use default ACLs so the default permissions would change of new created files, but we have another use case which requires a dynamical change of permissions of specific files.

Currently we're running a Debian Stretch 9.3 with Kernel 4.9.0-6.

So does anybody have an idea how to do this? Or is it simply not possible?

Edit:// To make some things clear. We don't want to allow a group to access the file of Bob or write to the directory. We want to change the file permissions, which is only allowed for the user itself (Bob) and root from another non root user, only in this specific directory.

  • Have the application be owned by Bob and make it setuid (but this won't work for e.g. shell scripts, only compiled applications: see this question ). – NickD Apr 4 '18 at 21:01
  • Why would you ever want that? – blissini Apr 4 '18 at 21:36
  • 1
    Is (nopasswd) sudo an option? – Jeff Schaller Apr 5 '18 at 0:19
  • 2
    handle it at your application level with correct permission checking with a deamon running as root able to change any kind of access. but that's for sure a lot of work to put inside your app but that's not how has been design unix permission in the first place. If you don't want files to belong to a group then you will need to do it either with sudo or with code in your app. – Kiwy Apr 5 '18 at 7:53
  • you say the permission will be : 755 ? but it can be changed: if the user as a different umask (ex: 027) it will delete the bit 2 ("x") for groups and delete all bits (7=bits 1+2+4 = rwx) for others. so by default a file will not be readable by "others", just by the group. and not executable by the group by default. – Olivier Dulac Apr 5 '18 at 18:14

You can try the "collaborative folder". For example I want group "project" to have access on folder,and group project(so all members of this group) can modify the files. The most important is chmod 2770,which mean 2(sgid,the files are created with the group owner) and 770 is readwrite access for uid and gid.

mkdir /projectfolder
groupadd project
chmod 2770 /projectfolder

If you want group project use folder but not delete files of other member of group use sgid+sticky

mkdir /projectfolder
groupadd project
chmod 3770 /projectfolder

Of course add bob to group project

If this don't work,the only solution(as I know) is sudo,is possible to assign group and specific command,for example,edit with visudo

User_Alias    PROJECT = bob
Cmnd_Alias    BOBCMD = /sbin/chmod


And if you need to use chmod only on specific folder,you can make a bash script and use this as sudo command. The script must control if user is ok,if dir is ok,and then run the chmod command.

  • Thanks for the reply. Sadly this isn't the problem. We'd like to have a user which is able to change the permissions of a file he hasn't created in this directory. Normally only the creator (Bob) and Root are able to change the permissions of a file, not a group member. So now we like to find a way how another user is able to change the permissions of the file Bob has created. – ForJ9 Apr 4 '18 at 20:31
  • Try sudo,is possible to assign group and user for specific command – elbarna Apr 4 '18 at 21:23
  • Yeah sudo seems to be a good choice. However I've to look if there's a programatically way of doing this. Exec a bash script isn't really nice. When I'm right then the Bash script will be executed as root, right? So I think the best way would be to write a simple daemon that wraps around chmod and runs as root and uses a unix socket to communicate with the main application and give the user "application" read and write permission to it. – ForJ9 Apr 4 '18 at 21:50
  • The script will be run as root,but using sudo,so is not too dangerous,simply create the script bash,then configure sudo to use it as user you select. – elbarna Apr 4 '18 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.