Allow non root user to change file permissions

Question

We're developing an application that makes it possible to change the file permissions of some files that users have created.

So e.g. the user "Bob" creates a file in /srv/share/ then bob is the owner of the file he created and only he and root are able to set the appropriate permissions.

Now we don't like to run our application as root, because of some security concerns. So is it possible in Linux to say that a user "Application" is able to modify the permissions of files that another user has createdin the directory /srv/share? And only there? Otherwise the user "Application" would be able to change some system files and is able to make himself root, which isn't intended of course.

Let's say Bob creates a file "test.txt" in /srv/share/ The permissions would look like this: UserOwner: Bob GroupOwner: AGroupName Permissions: 755

Now let's say our application would like to change the permission of the file "test.txt" to 770. That's only possible when the application runs as root. I know that it's possible to change the umask or use default ACLs so the default permissions would change of new created files, but we have another use case which requires a dynamical change of permissions of specific files.

Currently we're running a Debian Stretch 9.3 with Kernel 4.9.0-6.

So does anybody have an idea how to do this? Or is it simply not possible?

Edit:// To make some things clear. We don't want to allow a group to access the file of Bob or write to the directory. We want to change the file permissions, which is only allowed for the user itself (Bob) and root from another non root user, only in this specific directory.

Answer 1

You can try the "collaborative folder". For example I want group "project" to have access on folder,and group project(so all members of this group) can modify the files. The most important is chmod 2770,which mean 2(sgid,the files are created with the group owner) and 770 is readwrite access for uid and gid.

mkdir /projectfolder
groupadd project
chmod 2770 /projectfolder

If you want group project use folder but not delete files of other member of group use sgid+sticky

mkdir /projectfolder
groupadd project
chmod 3770 /projectfolder

Of course add bob to group project

If this don't work,the only solution(as I know) is sudo,is possible to assign group and specific command,for example,edit with visudo

User_Alias    PROJECT = bob
Cmnd_Alias    BOBCMD = /sbin/chmod

bob ALL= BOBCMD

And if you need to use chmod only on specific folder,you can make a bash script and use this as sudo command. The script must control if user is ok,if dir is ok,and then run the chmod command.