1

Is there any linux capability to enable normal users to write into root owned files like /etc/resolv.conf and /etc/fstab`?

2
  • You can use sudo to write as root (Assuming /etc/sudoers allows you to).
    – Rayleigh
    Jul 14 '20 at 18:04
  • If you're running a Linux distro which uses NetworkManager you don't even have to let users change this file. NM will manage it. Jul 14 '20 at 18:27
2

No. There's a capability that allows accessing arbitrary files regardless of permissions (CAP_DAC_OVERRIDE), but it's almost equivalent to granting root access (if you can overwrite /etc/passwd, with most configurations, you're in): it's only useful for processes that perform a specific task (for example a backup program), not to grant to a user. And there's no capability that allows bypassing permissions for specific files: capabilities are boolean, they aren't parametrized by a list of files. It would be pretty much pointless anyway because there's already a mechanism to allow users to write to specific files: permissions.

Create a group, add the users to the group, and grant the group write access to the file.

addgroup fstab-writers
adduser alice fstab-writers     # Note that this only takes effect when alice logs in, not in her already-running session(s).
chgrp fstab-writers /etc/fstab
chmod g+w /etc/fstab

If more than one group needs particular permissions on the file, use an access control list instead of chgrp and chmod.

setfacl -m g:fstab-writers:rw /etc/fstab

Note that if a system program overwrites the file in question, there's no guarantee that it'll reproduce the group ownership or the access control list. But if that's the case, you probably shouldn't be modifying this file manually anyway.

Also note that for both /etc/fstab and /etc/resolv.conf, there are well-established mechanisms that don't require giving users write permissions.

  • Giving a user write permission on /etc/fstab is equivalent to allowing them to run arbitrary commands as root. The easiest way is to mount a filesystem image with a setuid root executable, and there are others. If you want to allow users to mount filesystems, they can use udisks (which is what desktop environments use under the hood) or pmount.
  • /etc/resolv.conf is typically managed automatically by NetworkManager, which can be controlled by non-root users. This is what desktop environments use under the hood and there is also has a command line interface (nmcli). Even in the absence of NetworkManager, many distributions ship resolvconf to manage it automatically when the network connection changes.
4
  • Thank you! is resolvconf shipped by default in most modern widely used distros like anything Debian/Ubuntu based, Archlinux, NixOS and Fedora? Jul 14 '20 at 19:48
  • Well, I just found out that resolvconf needs root also Jul 14 '20 at 19:52
  • While I agree that using a capability that allows this, will give too much permission, and is not the way to go. The non-existent capability is CAP_DAC_OVERRIDE, or will a bit less privilege CAP_DAC_READ_SEARCH Jul 14 '20 at 20:54
  • @ctrl-alt-delor Good point! I mixed bypassing access control on all files, and bypassing access control on specific files. Jul 14 '20 at 23:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.