I am using the Consul Template project, which is a process that is responsible for rendering multiple template files into various locations on disk. This poses a challenge of how best to manage the permissions and ownership of the destination files without running the Consul template process as root.

For example, consul-template needs to render the contents of a template string and write it to locations such as /etc/default/. It does have the option of executing a command after rendering a template, so I can write to /tmp and then execute a sudo mv, but what would be a sane setting in the sudoers file to allow that?

I am building the servers with configuration management and know all of the destination files at build time, so I can change ownership of the destinations at that point, but the process also creates temporary files during rendering that are located in the destination directories which complicates things a bit.

If anyone has dealt with a similar situation of needing to grant broad write permissions to a non-root process and has a solution that they're happy with I'd appreciate some feedback. Thank you in advance for the help.

1 Answer 1


So, after digging around more I discovered the Linux ACL system and was able to manage the necessary permissions via installing the acl package and then running setfacl -m u:<username>:rwx /etc/default.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .