Allow non-root user to change group for it's own files

Question

My server at home uses rsync to backup files to my VPS, but I have an issue with setting the group property for uploaded files. Because the rsync uploads the data to a folder which can also be accessed from my FTP user I need them to have the ftpgroup group, otherwise I cannot download nor modify the files via FTP.

My rsync looks like this:

rsync -rtuvz --chmod=770 --owner --group --chown=user:ftpgroup /var/ftp/[email protected]/files/rsync_backup/ [email protected]:"/var/ftp/[email protected]/files/rsync_backup/"

The --chown flag with the rsync tool does not change anything, the files always have the group of the user that uploaded the files.

I've tried to set the group property via SSH but apparently only root users can use chown and chgrp, but I don't want to edit the sudoers file and give the user full access to chown, it's obviously a security hazard.

Is there a way to grant the user permissions to change group only for the files that he owns?

Answer 1

From chown(2)

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member

If user is not part of the group ftpgroup, then user cannot change to group of a file or directory to ftpgroup. To solve this you could add user to the group ftpgroup by running

usermod -a -G ftpgroup user

on the server as root.

Alternatively, if /var/ftp/[email protected]/files/rsync_backup/ is expected to only contain files owned by the group ftpgroup, then you could change ownership of /var/ftp/[email protected]/files/rsync_backup/ to ftpgroup and set the setgid bit on the directory

chown :ftpgroup /var/ftp/[email protected]/files/rsync_backup/
chmod g+s /var/ftp/[email protected]/files/rsync_backup/

The setgid bit on a directory causes all newly created files in that directory to have the group ownership of the directory and similar with directories but also set the setgid bit on them. If there are any existing files and directories in /var/ftp/[email protected]/files/rsync_backup/ you will have to manually change ownership and set the setgid bits on the directories.