5

At my school we have a shared server environment with several users and several groups.

Relavent Groups:

students

daemon (runs apache)

I want to allow students to be able to have full access to files they own and no access to other students files.Two different students should not be able to even see each others files.

I also want apache to be able to read and execute all student files. Specifically I want apache to be able to read a password file owned by each student, I also want the owner of the password file to have full access to it.

From my understanding, the best way to do this is to change the group owner of the password file to be apache.

So after reading this,

https://serverfault.com/questions/357108/what-are-the-best-linux-permissions-to-use-for-my-website

it seems a simple chgrp would fix it.

But then I run into this:

You must be owner of the file(s) as well as a member of the destination group (or root) to use this operation.

So each of the students are not a part of the daemon group, they cannot run this command. Giving them that group would be pointless in that they would be able to see other student's password files as well.

From the previous thread I gathered that the current security settings are unfit and I have scheduled a meeting with my system administrator tommarrow.

But I'm still unsure what I should ask my systemadmin to do.

I can't really ask him to manually change the permissions for every password file on the server, the filenames and locations are different and many students are not even set up yet.

Allowing students to have full access to chgrp seems dangerous,

My inclination seems to ask him to create some type of script that would prompt the student for a file and then run chgrp in place of the student, thus giving apache group ownership. This seems viable, but also pretty complicated as I'm still pretty new to Linux. Would he be able to do something like this easily?

I've also considered ACL's but my train of thought goes right back to chgrp, giving students access to setacl seems dangerous.

Improve this question

1 Answer 1

Reset to default
4

ACLs are the answer. The students don't need any special permission to run setfacl, a user can set the ACL of any file that he owns.

If you need to set up your system for ACLs, see Make all new files in a directory accessible to a group

Tell students that if they need a file to be accessible to Apache, then they must run

setfacl -m group:daemon:r ~/path/to/password.file
setfacl -m group:daemon:x ~ ~/path ~/path/to

The x permission on the directories is necessary to access files (including subdirectories) in these directories.

Improve this answer
3
  • I discussed this option with my system admin, they seem to have the same concerns that I have. They said setacl can only be executed by root.
    – Ray
    Commented Aug 8, 2012 at 19:01
  • When I try to execute it however I'm not getting a Operation not permitted error. Instead I get an Operation not supported error. [me@server ~]$ setfacl -m group:nobody:r passwordfile setfacl: /some/path/passwordfile: Operation not supported Is my system admin right, or is the something configured incorrectly Additional note we renamed dameon back to nobody as it made no sense to keep it like that
    – Ray
    Commented Aug 8, 2012 at 19:09
  • 1
    @Ray If your sysadmin said this, he was wrong. The EOPNOTSUPP error means that the filesystem is mounted without the ACL option. The system administrator must modify /etc/fstab to add the acl option (my linked post). Once this is done, anyone can change the ACL on the files they own. P.S. Never run any process as nobody or have any file owned by nobody: it's meant to be a user/group that is never used. Create a separate group called daemon to run Apache.
    – Gilles 'SO- stop being evil'
    Commented Aug 8, 2012 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .