3

I need to create a kind of "backup operator" account, which can read all the files on a system for copying to a backup system without the permission to modify any of them, including those belong to root.

The root account seems to be the only one capable of doing that, but then the root account is not prevented from running anything it wants. The other option I can think of is placing an account in a group that as read rights and make that account a member of every users group. The basic rwx permissions in Linux don't seem created for that.

Does Linux have something more sophisticated for such a purpose such as something ACLs might offer?

The permissions are for a user who logs in from a remote backup server and backups up all the files to the remote server. If the backup server gets compromised that account should not be able to log into the server being backed up and do some damage. Accounts on the backed up server should also not be able to log into the backup server and do some damage if gets compromised.

1
  • When i did this, i created a user whom could one run one command via ssh key login and that ran a backup script Aug 5 '18 at 20:19
4

I suppose usually, one would just run the backup utility as root, through cron or through a forced command on an SSH key, and then trust the utility to not do anything dangerous.

Using ACLs to give permissions to all files on the system would be a bit awkward, since you'd need to have the ACLs set for each and every file individually (as POSIX ACLs don't really have a concept of giving access to a subtree, you just have default ACLs that automatically get copied to new files). And the owners of those files can just go and remove those permissions, accidentally or on purpose. Security-conscious programs (like SSH or GPG) might also get a bit angry if they notice your files are readable by someone else. (They don't even need to know about ACLs to do that, since the traditional permission bits mask the permissions granted by the ACLs, so any access granted by ACLs is evident in the traditional permission bits.)

However, there actually is a way. The Linux capabilities system contains a capability just for that:

CAP_DAC_READ_SEARCH

  • Bypass file read permission checks and directory read and execute permission checks;
  • invoke open_by_handle_at(2);
  • use the linkat(2) AT_EMPTY_PATH flag to create a link to a file referred to by a file descriptor.

(I'm not sure how the that last one is related to the others, but I'll ignore it...)

If you have a particular utility you want to have that capability, you can give it to it with setcap:

# setcap "CAP_DAC_READ_SEARCH+ep" /path/to/backupcmd

Though now, anyone who can run the binary /path/to/backupcmd, will have access to that ability. So, you probably want to protect that particular file from access by arbitrary users. For example, make it owned by root:backup, with permissions rwx--x---, where backup is the group of users who are supposed to be able to run it.

# chown root:backup /path/to/backupcmd
# chmod 710 /path/to/backupcmd
4
  • Would an rsync wrapper ie the one used by the --remote-rsync option be the kind of command given that capability? When I run rsync it is unable to copy some long files created by the web server even if they are under the user's home directory. How would I structure such a wrapper?
    – vfclists
    Aug 5 '18 at 18:19
  • There is a serverfault question which could do with this kind of advice.
    – vfclists
    Aug 5 '18 at 18:20
  • 1
    @vfclists, do you mean --rsync-path? I suppose you could just have a copy of rsync with the appropriate capabilities set... I'm not sure how it would work with a wrapper script.
    – ilkkachu
    Aug 5 '18 at 20:27
  • Yes, I meant --rsync-path
    – vfclists
    Aug 6 '18 at 4:58
2

You are looking for sudo

sudo is a program for Unix-like computer operating systems that allows users to run programs with the security privileges of another user

2
  • That would require adding the account to the sudoers file which would mean that it would have root user rights across the entire system which isn't wanted. Aug 5 '18 at 15:50
  • No, that doesn't mean root rights for everything. You can give root access just for the command to run the backup-utility. See man sudoers. Something like someone ALL= NOPASSWD: /path/to/backupscript
    – markgraf
    Aug 15 '19 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.