5

I am fully aware that a non-root user cannot change the owner of a folder to another user even if the user owns it unless they use sudo or have the CAP_CHOWN capability.

Is there a way to grant a specific non-root user permissions to change the owner of a directory which it owns via sudo or some other command but not allow the user to arbitrarily change the owner of directories it does not own?

I have a server (running as the non-root "myserver" user) and want it to be able to create specific directories for local users, and when its done with a directory change the owner of it to the desired user.

4
  • possible duplicate of Why unprivileged user can't change file ownership?
    – techie007
    Sep 9, 2013 at 19:05
  • 3
    Not a duplicate, the linked post is about why and this one is about how can I get around it.
    – terdon
    Sep 9, 2013 at 19:09
  • Why not just write a e.g. shell script that checks the required restrictions and allow the non-root user to sudo that instead of chmod? Sep 9, 2013 at 19:57
  • 1
    Migrating as requested by user. Sep 9, 2013 at 19:57

1 Answer 1

4

sudo does not have a built-in way to do this. The basic approach is to write some helper program that makes various checks (does user X own this directory? Is it in the expected path? Are the permission bits sane? Etc.) and then does the chown.

You then allow user X to run the helper, as root, via either sudo or filesystem permissions (make the helper suid root, executable only two the daemon's group, or even the daemon's user with ACLs).

The helper, of course, needs to be written with security in mind.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .