I am fully aware that a non-root user cannot change the owner of a folder to another user even if the user owns it unless they use sudo or have the CAP_CHOWN capability.

Is there a way to grant a specific non-root user permissions to change the owner of a directory which it owns via sudo or some other command but not allow the user to arbitrarily change the owner of directories it does not own?

I have a server (running as the non-root "myserver" user) and want it to be able to create specific directories for local users, and when its done with a directory change the owner of it to the desired user.

  • possible duplicate of Why unprivileged user can't change file ownership? – techie007 Sep 9 '13 at 19:05
  • 3
    Not a duplicate, the linked post is about why and this one is about how can I get around it. – terdon Sep 9 '13 at 19:09
  • Why not just write a e.g. shell script that checks the required restrictions and allow the non-root user to sudo that instead of chmod? – Daniel Beck Sep 9 '13 at 19:57
  • 1
    Migrating as requested by user. – Daniel Beck Sep 9 '13 at 19:57

sudo does not have a built-in way to do this. The basic approach is to write some helper program that makes various checks (does user X own this directory? Is it in the expected path? Are the permission bits sane? Etc.) and then does the chown.

You then allow user X to run the helper, as root, via either sudo or filesystem permissions (make the helper suid root, executable only two the daemon's group, or even the daemon's user with ACLs).

The helper, of course, needs to be written with security in mind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.