0

In pharmacies, certain drugs are put in a time-delay safe, which means there is a fixed lag between the retrieval request and the time the safe is able to open (say maybe 15 minutes). I'm wondering if it's possible to do this with the editing permissions of a file, where the delay is enforced even if you're root.

And, if this is not possible, is it possible to encrypt a file in a time-delayed manner? Something more elegant and precise than "it would take about n years to brute force it".

12
  • 2
    Exclude root and this issue could be achievable. Root is the administrative account, though, so if you give someone access to this account you have given them the system. Commented Aug 9, 2021 at 14:02
  • 2
    this sounds like an XY Problem about to happen, or maybe just some weird what-if hypothetical. What problem are you actually trying to solve?
    – cas
    Commented Aug 9, 2021 at 14:58
  • 1
    Then take a tip from visudo - don't let them edit the file directly, let them edit a copy of it and check that there are no syntax errors. e.g. make the file immutable, write a "edit_my_special_file" script that copies it, runs $EDITOR on the copy, checks that the result of the edit has no errors and if it does, remove the immutable attribute on the original, replace it with the new version, and make it immutable again. Note that like visudo, this can only verify that the syntax is valid, it can not check that what the new config file does is actually sane or does anything useful.
    – cas
    Commented Aug 10, 2021 at 5:15
  • 1
    and you should still use version control. Reverting to the last known-good, working version of a file from the history is a lot quicker and easier than trying to figure out what your co-worker did and undo-ing it. The commits can be automated in the scripts too - commit the current version before editing if git status says that it has been modified but not yet commited (message could be something like "autocommit before edit"). A successful edit would trigger a commit with a message like "Edited by $SUDO_USER".
    – cas
    Commented Aug 10, 2021 at 5:22
  • 1
    The diffs from these commits can be used to see what was done in each edit, and is especially useful for teaching (not berating!) your co-worker what they did wrong and how to do it correctly. BTW, even just knowing that every edit is tracked can be enough to encourage caution when editing the file.
    – cas
    Commented Aug 10, 2021 at 5:29

1 Answer 1

3

You clarified in a comment that

there's a user who needs occasional root access and I don't want them to be able to modify a specific file on the machine until they've had at least n minutes to potentially think about it.

I might approach this in one of a number of ways. I assume it's a single file that should be considered for editing.

Consider a script /usr/local/bin/myedit. Add the user into the group myeditors, or if it really will ever only be a single user, change the %myeditors value to the username. Using visudo add this line to the sudoers file

%myeditors ALL=(ALL) NOPASSWD: /usr/local/bin/myedit

Now create the script /usr/local/bin/myedit, remembering to make it executable (chmod a+x /usr/local/bin/myedit).

#!/bin/bash
#
# THIS SCRIPT RUNS AS ROOT
#
# %myeditors ALL=(ALL) NOPASSWD: /usr/local/bin/myedit
########################################################################

# User configurable values
target='/usr/local/etc/specialfile'    # The file to be edited
delay=600                              # Delay in seconds

########################################################################
# Here we go
#
progName="${0##*/}"

# Reset PATH to known quantity
export PATH=/usr/local/bin:/bin:/usr/bin

# Force the script to run with sudo
[[ $(id -u) != 0 ]] && exec sudo "$0" "$@"

printf 'Waiting %d seconds...' $delay
sleep $delay && echo

read -t 60 -p "Are you sure you still want to edit $target (y/N)? " YN
[[ "${YN,,}" =~ ^(y|yes)$ ]] || exit 1

umask 0022
tmpf=$(mktemp -d "/tmp/${progName}_XXXXXXXXXX")
cp -f "$target" "$tmpf"

# Revert to the original user account to edit the temporary file
chown "$SUDO_USER" "$tmpf"
sudo -u "$SUDO_USER" "${EDITOR:-vi}" "$tmpf"

# Apply changes
if [[ -f "$tmpf" ]] && ! cmp -s "$target" "$tmpf"
then
    echo 'Applying changes'
    cp -pf "$target" "$target.old"
    cp -f "$tmpf" "$target"
fi

# All done
rm -f "$tmpf"
exit 0

Invoke the command without sudo (although it doesn't matter if you use it):

myedit
1
  • 1
    or let them edit first, then force them to stare at the edited file for those 600 seconds before putting it in place...
    – ilkkachu
    Commented Aug 9, 2021 at 18:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .