0

My monitoring system runs with lowered permissions but I want it to run a command that needs access a particular file in a folder that the monitoring system is not allowed to enter.

The usual approach would be for me to add that command–user combination to my sudoers file and change the configuration such that the command is executed with sudo. However, I feel that this will give the command in fact many more rights than are needed (I don’t need any write permissions at all).

Is there a sudo-like program that can execute a command as the same user but with the only difference that a particular (pre-defined) file or folder is then accessible? (The file/folder could even have a different name.) Could there be a way to accomplish this with mount namespaces?

11
  • Does this answer your question? unix.stackexchange.com/questions/215412/… Commented Jan 9, 2020 at 12:43
  • Do you want to read the file or to execute it? Commented Jan 9, 2020 at 12:51
  • @QuoraFeans Unfortunately not. The thing is that I guess I don’t trust my command 100% so I don’t want to give it full sudo permissions
    – Debilski
    Commented Jan 9, 2020 at 12:58
  • 1
    @Debilski, in such case use ACL. But if external process change it this may change also ACL. Commented Jan 9, 2020 at 13:01
  • 1
    If the files are in a specific directory, you could set default ACLs on that directory so every file in it is readable by your user. You could also make it group-readable, and ensure it is owned by a group that your process is in.
    – Stewart
    Commented Jun 30, 2021 at 16:23

1 Answer 1

0

As a partial solution to this problem that works for small files in a read-only setting, this can partially (read-only) be accomplished by using the LoadCredential directive in a system’s .service file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .