0

So I've got a situation where programX.py creates files such as file1.txt.

How could one make it so that only programX.py has the rights to edit (write to) file1.txt?

So anything else (such as a user) cannot edit file1.txt - they would only be able to read from it.

I've read up about digital signatures (gpg), but I'm not sure if it would be feasible in terms of system resources to unlock the file -> write -> lock file whenever there is something to be written to the file.

Ideally, the (read-only except for programX.py) mechanism would already be applied to the file under its properties when it is created by programX.py for the first time - that way there would be no need to be constantly unlocking and locking the files.

Improve this question
1
  • Can you explain what the motivation for the question is? At the moment it is a bit ill-defined, since we have no notion of some executable "owning" anything else. Instead, it is users/groups who may or may not have executable permissions to run the program, and (usually) the output will then be owned by whoever did this. I do have a rough idea for something which might be what you're after, but I'd prefer to see the question clarified first. – cryptarch Feb 4 at 17:48
1

Run programX.py as a separate functional user account and group. This will cause all files created by that program to be owned by the functional account. Set the umask in the functional accounts profile to 0077. This will limit access to the files to the functional account only.

From there, within programX.py you can set the mode of the file you wish to allow others to read when you create the file (ie mode 640 or 644).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.