A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can be also read by a regular user. The question is whether there is a way to restrict anyone but root and the application from reading the file.

  • Probably overkill, but encrypt the file with a GPG key, put that key in root's keyring, and embed the key in the app's source code (split up, xor'd, etc as needed according to your threat model). Commented Dec 10, 2015 at 0:14
  • Write that capability into the kernel's code and recompile it.
    – iAdjunct
    Commented Dec 10, 2015 at 1:45
  • Is 'regular user' one user, or many users who are not root?
    – amccormack
    Commented Dec 10, 2015 at 17:26

1 Answer 1


Create a new user called X. Make the file only readable by X. Change ownership of the app file to X and make it setuid. Now only the app and root can access the file.

  • 2
    Why SETUID? Shouldn't chowning and chmod 0600ing the file do the trick? Commented Dec 10, 2015 at 7:14
  • Classically, have the data owned by X readable only by owner, and the application SUID to X but executable by the desired user(s). This only works for a 'native' app; apps using interpreters like Java, python, perl/php need the interpreter SUID-to-X and that's usually too big a hole. On modern systems, instead use sudo to let the desired user(s) run the application as X, but not do anything else as X. Commented Dec 10, 2015 at 9:40
  • @stackzofstuff - I meant setuid the app. Clarified answer. Commented Dec 10, 2015 at 15:07
  • @dave_thompson_85 - I still think you can use setuid. You could put it on a script that calls the interpreter. If user X only has permission for accessing the one file, it's not a security problem. Commented Dec 10, 2015 at 15:10
  • 1
    You can try playing around with seteuid @Evgeny. That will change the UID of the app back to the calling user's UID. You must open the protected file before calling seteuid so the order should be: app starts, app opens protected file, app sets EUID back to real UID. Google effective real UID for more info. Commented Dec 12, 2015 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .