0

Supouse I have a directory /opt/expe and I want any user to create .txt files on it. I want any user to type something like this:

$ whoami
user1
$ export $file_name=my_txt_file
$ /opt/expe/create_file.sh
$ ls -cal /opt/expe
total 12
drwxr-xr-x 2 root  root 4096 Jul 29 19:27 .
drwxr-xr-x 6 root  root 4096 Jul 29 19:14 ..
-rwsr-sr-t 1 root  root   65 Jul 29 19:29 create_file.sh
-rw-r--r-- 1 user1 root    0 Jul 29 19:27 my_txt_file.txt

I try this with a sudoer

$ whoami
user_sudoer
$ cat /opt/expe/create_file.sh
touch /opt/expe/$file_name.txt
chown $USER /opt/expe/$file_name.txt
$ chmod a+x /opt/expe/create_file.sh
$ chmod a+t /opt/expe/create_file.sh
$ chmod a+s /opt/expe/create_file.sh
$ chmod a+X /opt/expe/create_file.sh

Then with non-root user I obtained:

$ whoami
user1
$ export $file_name=my_txt_file
$ /opt/expe/create_file.sh
touch: cannot touch '/opt/expe/prueba_txt.txt': Permission denied

Can I do something like this. I want something like postgres SECURITY DEFINER concept.

Emilio Platzer
  • 234

1 Answers1

1

I am not familiar with Postgres enough, but I see at least 4 options:

  1. Change permissions of /opt/expe with chmod to allow all users create files within this directory.

  2. Create a separate group for the users which need to write there and change /opt/expe group permission with chmod to allow this group write there.

  3. Create a separate group and add sudoers rule to let them execute this script as described for example here: How can user mount an encrypted file container in VeraCrypt?

  4. Use label security for fine-grained access control. Here is brief description of security labels and some further links: https://unix.stackexchange.com/questions/53028/what-are-ext4-security-labels

Please bear in mind that the permission to create/remove files is a property of the directory and not the file itself.

Pawel Debski
  • 2,704
  • 8
  • 28
  • 40
  • Options 1 & 2 are not what I ask. Option 4 is interesting but I don't found an answer in it. Option 3 looks like I need, I try something but it doesn't works. Here Is my refined question: https://askubuntu.com/q/941273/672702. I hope thats the way. If it was, the option 3 is the path to the answer. I don't know yet. Thanks – Emilio Platzer Jul 30 '17 at 16:23
  • I see it's harder than I thought. Here are more info: https://es.stackoverflow.com/a/92856/184 – Emilio Platzer Aug 05 '17 at 12:51