Is there any linux capability to enable normal users to write into root owned files like
/etc/resolv.conf and /etc/fstab`?
No. There's a capability that allows accessing arbitrary files regardless of permissions (
CAP_DAC_OVERRIDE), but it's almost equivalent to granting root access (if you can overwrite
/etc/passwd, with most configurations, you're in): it's only useful for processes that perform a specific task (for example a backup program), not to grant to a user. And there's no capability that allows bypassing permissions for specific files: capabilities are boolean, they aren't parametrized by a list of files. It would be pretty much pointless anyway because there's already a mechanism to allow users to write to specific files: permissions.
Create a group, add the users to the group, and grant the group write access to the file.
addgroup fstab-writers adduser alice fstab-writers # Note that this only takes effect when alice logs in, not in her already-running session(s). chgrp fstab-writers /etc/fstab chmod g+w /etc/fstab
If more than one group needs particular permissions on the file, use an access control list instead of
setfacl -m g:fstab-writers:rw /etc/fstab
Note that if a system program overwrites the file in question, there's no guarantee that it'll reproduce the group ownership or the access control list. But if that's the case, you probably shouldn't be modifying this file manually anyway.
Also note that for both
/etc/resolv.conf, there are well-established mechanisms that don't require giving users write permissions.
- Giving a user write permission on
/etc/fstabis equivalent to allowing them to run arbitrary commands as root. The easiest way is to mount a filesystem image with a setuid root executable, and there are others. If you want to allow users to mount filesystems, they can use udisks (which is what desktop environments use under the hood) or
/etc/resolv.confis typically managed automatically by NetworkManager, which can be controlled by non-root users. This is what desktop environments use under the hood and there is also has a command line interface (
nmcli). Even in the absence of NetworkManager, many distributions ship resolvconf to manage it automatically when the network connection changes.