Root couldn't write to file with rw permissions for all users and owned by other user

Question

I have script that can be runned from different users on the same machine. This script should write logs to the same file on every run.

Minimal version of script:

#!/usr/bin/env bash
                                  # 2
touch /var/tmp/lll.log            # 3
chmod 666 /var/tmp/lll.log        # 4 (You can comment this line, but  this will change nothing)
echo ghghhghg >> /var/tmp/lll.log # 5

There is no problem when it started from root and then from other user, but error thrown when order is opposite.

./savetmp.sh: line 5: /var/tmp/lll.log: Permission denied

Output of ls -ld /var/tmp /var/tmp/lll.log:

.rw------- 9 armoken  1 May 10:52 /var/tmp/lll.log
drwxrwxrwt - root     1 May 10:52 /var/tmp

cat /proc/sys/fs/protected_regular:

1

How to fix that?

Answer 1

When you run this as the user armoken the file is created according to your current permissions settings, which are such that you can read/write the file but no-one else can:

ls -l /var/tmp/lll.log
-rw------- 9 armoken  1 May 10:52 /var/tmp/lll.log

So when other users try to write to this file they have no permission to do so.

However, it's more complicated than this because you have the protected regular files security feature enabled in your system's kernel (cat /proc/sys/fs/protected_regular returns non-zero). This means that, regardless of these permissions, no-one other than the owner can write to a file in a sticky directory such as /var/tmp - not even root - unless the file is owned by the owner of the directory itself.

So, if you want everyone to be able to read/write this file in this directory you need to set it up so that root owns it and that anyone can write to it. But bear in mind this means other people can erase or change content in the file too.

#!/bin/sh
if [ ! -f /var/tmp/lll.log ]
then
    # File does not exist
    if [ "$(id -u)" -eq '0' ]
    then
        # We are root so create the file (and continue)
        >/var/tmp/lll.log
        chmod a=rw /var/tmp/lll.log
    else
        echo 'ERROR: Log file does not exist. Have your systems administrator create it before proceeding' >&2
        exit 1
    fi
fi

# Now anyone can read/write the contents of the file
echo 'This is a test message' >>/var/tmp/lll.log

This is not defensive coding, though, as anyone can still create the file and prevent others from using it.

A better solution might be to use a logger. For example, this will write to the files managed through journalctl (and/or /var/log/user.log otherwise)

logger 'This is a test message'

journalctl --since today | tail
…
May 01 10:14:24 myServer myUser[18892]: This is a test message
…