0

Sometimes a command I'm executing needs to access a directory that's owned by root, e.g. npm install -g ... might put a symlink in /usr/local/bin

I don't wish to run the command using sudo because then every file it has touched will be owned by root (e.g. if you try sudo touch tmp then issue ll you'll see it's owned by root and in root group), but I still want to give it access to /usr/local/bin

Currently I temporarily change the ownership of the directory to (whoami) and then changing it back to root.

Is there a way that linux can allow me same access as root but the files touched/written are given ownership under the current user? e.g. by using a command idk npm install -g .... Where idk is something other than sudo.

Note that this question isn't about the specific example / use case of /usr/bin/local. As any linux user is well aware, you could change directory permissions permanently so that permissions issue doesn't arise anymore.

The question is about ability to do this on a command by command basis (like sudo gives root permissions on a command by command basis).

Linux permissions have the model "x user can do p", and sudo lets you say "let user x behave as if they were user y". I'm asking if there is a way to say "let user x behave as if they were y, but keep a note of the fact that it's really x and not y".

4
  • 1
    Use ACLs to grant your user write access to /usr/bin/local? (Is that supposed to be /usr/local/bin?) – muru Dec 16 '20 at 9:14
  • @muru. yeah, I'll fix it. Please see my comments on existing answers about why this isn't what I'm asking for. – Peeyush Kushwaha Dec 16 '20 at 11:05
  • In that case I think this is an XY problem and you haven't really clarified what X is. What's the problem with the files being owned by root, for example? – muru Dec 16 '20 at 14:00
  • What are the permissions of things in /usr/local/bin? I would normally expect -rwxr-xr-x or 755 which allows anyone to run the application. The binary may be owned by root, but the application is executable by anyone. This is how things in /usr/bin work. – Stewart Dec 27 '20 at 8:20
2

First sudo is more than just giving root access, but not of relevance here.

Your question does not seem to be about being root. It seems to be about having permission to write to a directory.

Use ACLs, to add group permission, and to add a default so than new files have this same group permission.

  • Create a group for this task
  • add your self to this group (it is easiest to logout and back-in at this stage, but there are ways to avoid this (newgrp, but an understanding of how processes inherit ownership is needed to avoid being confused).
  • Recursively add group permission to directory setfacl -R -d -m g:«group»:rwx . setfacl -R -m g:«group»:rwx . (from memory: untested)

giving access to just some programs

Combine the above with sudo: i.e. `sudo --group «group» command,

or

use set-gid of the program (does not work on interpreted languages).

2
  • ACLs are well but what you're proposing doesn't limit the access to command-by-command basis, right? Might as well change group / owner of target files rather than use ACLs then. – Peeyush Kushwaha Dec 16 '20 at 11:05
  • ACLs allow you to add additional permissions in addition to owner and owning group. It is often undesirable to change the file's owner while one wants just to add permissions to that file/directory for an additional user. You said you were temporarily changing the file owner to be able to access it. You can avoid just that using ACLs. Coming from a world of OS that had a very complex and flexible permissions system (George 3, anyone remembers that?) I always considered Unix permissions system too limited. ACLs add the flexibility that basic Unix permissions system lacks. – raj Dec 16 '20 at 11:58
0

If you're working with /usr/local exclusively you could just chown -R username /usr/local That way no root access will ever be needed which is still safer than using root/sudo. This directory in most Linux distros is not used for anything at all.

1
  • The directory is automatically put on PATH and chowning it is less desirable to prevent programs writing to it randomly. I want to give permissions to programs to access it on a command by command basis, if possible. – Peeyush Kushwaha Dec 16 '20 at 11:02
0

The reason why /usr/local/bin is owned by root is because it's in the search path of every user, including root itself. If you put files in there not owned by root, then other users will potentially execute those files with dire consequences.

Just consider this, if you have an executable whatever owned by user:user in /usr/local/bin and your user account is compromised then that file could be replaced. This file would then be in the search path of root and every other user on the system.

It's not clear what's wrong the ownership by root. It's there to protect you.

Not the answer you're looking for? Browse other questions tagged or ask your own question.