My monitoring system runs with lowered permissions but I want it to run a command that needs access a particular file in a folder that the monitoring system is not allowed to enter.

The usual approach would be for me to add that command–user combination to my sudoers file and change the configuration such that the command is executed with sudo. However, I feel that this will give the command in fact many more rights than are needed (I don’t need any write permissions at all).

Is there a sudo-like program that can execute a command as the same user but with the only difference that a particular (pre-defined) file or folder is then accessible? (The file/folder could even have a different name.) Could there be a way to accomplish this with mount namespaces?

  • Does this answer your question? unix.stackexchange.com/questions/215412/… – Quora Feans Jan 9 at 12:43
  • Do you want to read the file or to execute it? – Romeo Ninov Jan 9 at 12:51
  • @QuoraFeans Unfortunately not. The thing is that I guess I don’t trust my command 100% so I don’t want to give it full sudo permissions – Debilski Jan 9 at 12:58
  • @RomeoNinov I just want to read the file – Debilski Jan 9 at 12:58
  • 1
    @Debilski, in such case use ACL. But if external process change it this may change also ACL. – Romeo Ninov Jan 9 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.