Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
in script a.sh:
chown -R root:group parent-folder/
chown -R root:group parent-folder/*
The script runs as root user.
When chown gets executed it show below SELinux violations:
chown : type=1400 audit(0.0:7): avc: denied { dac_override } for capability=1 scontext=u:r:scriptName:s0 tcontext=u:r:scriptName:s0 tclass=capability permissive=1
What do I need to do to avoid the above dac_override ? (I dont want to apply the dac_override SE policy of course)
You need to run the process with user/group which has required DAC permissions to access and modify the files. The process can not not change owner of the file without CAP_CHOWN capability. File owner can change the group to another group which the process is member of. Recursive chown also needs to have (at least) search permission to the directory in question.
For more details, see the man pages chown(2) and capabilities(7).
