Customized chown Linux Command
Question: want to change the file owner and permission as required by a normal user (not root) !
Solution:
- chown or chmod ; will occur the error “Operation not permitted” because it required root permission.
- Via sudo, it is not easy.
- C code and SUID
I go with 3) for easy customizing and just configure via shell script. And because kernel 2.6.x have several security improvement, it make the chown & chmod in shell script (enable SUID) not working. So must have C code wrapper for do it as example /usr/local/bin/chown_test.c
/usr/local/bin/chown_test.c
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
/* chown_test.c */ #include #include #include #include /* int main() { setuid( 0 ); system( "/usr/local/bin/chown_test.sh" ); return 0; } */ int main ( int argc, char *argv[] ) { if ( argc != 2 ) /* argc should be 2 for correct execution */ { /* We print argv[0] assuming it is the program name */ printf( "usage: %s filename\n", argv[0] ); return 1; } else { char commands[255]; sprintf(commands,"/usr/local/bin/chown_test.sh %s",argv[1]); setuid( 0 ); system(commands); /* printf( "== %s", commands ); */ } return 0; } |
Build execute binary “chown_test” and change permission only root access for C code
|
1 2 3 4 5 6 |
[root@dev01 ~]# cd /usr/local/bin [root@dev01 bin]# gcc -o chown_test chown_test.c [root@dev01 bin]# chmod 700 chown_test.c [root@dev01 bin]# chmod 4755 chown_test |
/usr/local/bin/chown_test.sh Custom owner.group and directory specific over !
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
# /usr/local/bin/chown_test.sh #!/bin/bash usage() { echo "usage: chown_test filename" echo "filename: must full path, and under directory /test/ only !" echo "example: chown_test /test/A.txt" } if [ $# -gt 1 ] ; then usage else param1=$1 if [ ${#param1} -ge 4 ] ; then p=0 l=5 param1_substr=${param1:p:l} if [ $param1_substr == '/test/' ] ; then if [ -f $param1 ] ; then chown test.test $param1 else echo "$param1 does not exist" fi else usage fi else usage fi fi |
change permission only root access for .sh (configuration part!)
|
1 2 3 4 |
[root@dev01 ~]# cd /usr/local/bin [root@dev01 bin]# chmod 700 chown_test.sh |
/usr/local/bin is the default in $PATH. Now, we can use chown_test for changing file owner.group under /test directory.
Advanced File Permissions in Linux
Here we will discuss about the 3 special attributes other than the common read/write/execute.
Example:
drwxrwxrwt – Sticky Bits – chmod 1777
drwsrwxrwx – SUID set – chmod 4777
drwxrwsrwx – SGID set – chmod 2777
combile All: Sticky Bits +SUID set + SGID set : chmod 7777
Sticky bit
Sticky bits are mainly set on directories.
If the sticky bit is set for a directory, only the owner of that directory or the owner of a file can delete or rename a file within that directory.
Example:
Consider you have a directory ” test “.
chmod it to ” 777 “. This gives permissions for all the users to read, write and execute.
chmod +t test
Example: ls -al
drwxrwxrwt 2 a1 a1 4096 Mar 13 2012 .
-rw-rw-r– 1 a1 a1 0 Mar 11 17:30 1.txt
-rw-rw-r– 1 b2 b2 0 Mar 11 22:52 2.txt
From the above example a1 is the owner of the test directory.
a1 can delete or rename the files 1.txt and 2.txt.
b2 can delete or rename the file 2.txt only.
SUID – [ Set User ID ]
SUID bit is set for files ( mainly for scripts ).
The SUID permission makes a script to run as the user who is the owner of the script, rather than the user who started it.
SGID – [ Set Group ID ]
If a file is SGID, it will run with the privileges of the files group owner, instead of the privileges of the person running the program.
This permission set also can make a similar impact. Here the script runs under the groups ownership.
You can also set SGID for directories.
Consider you have given 2777 permission for a directory. Any files created by any users under this directory will come as follows.
Example:
drwxrwsrwt 2 a1 a1 4096 Jun 13 2012 .
-rw-rw-r– 1 b1 a1 0 Jun 11 17:30 1.txt
-rw-rw-r– 1 c3 a1 0 Jun 11 17:30 2.txt
-rw-rw-r– 1 d4 a1 0 Jun 11 17:30 3.txt
So all the a1 user has access to all the files under the test directory. He can edit, rename or remove the file.
b1 user has access to 1.txt only, c3 has access to 2.txt only…
If sticky bit was not set for the test directory, any user can delete any files from the test directory, since the test directory has 777 permissions. But now it not possible !.
