0

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the HTTP server - both of which belong to the same group.

I want the synced files to be owned by the "owner" user and I don't want the HTTP server user to be able to write to them. However, I want the HTTP server user to be able to invoke the sync script.

One option is to wrap the shell script in a small C application and use setuid so the HTTP server user can run it as the "owner" user.

Given that:

  • There will be no input to the script - the remote location, destination location, etc. are all constant.
  • The setuid script won't be owned/run by root.

Is this a safe and sensible thing to do?

Edit:

For the sake of explaining things you can use the following names:

  • deploy-user: The user who should own the files
  • www-user: The user running the HTTP server
  • www-group: The group deploy-user and www-user belong to
  • sync.sh: The script which updates the file
  • sync.txt: The target file
|improve this question
1

If I'm understanding your question correctly, I believe the easiest solution is:

chgrp <user> /path/to/syncfile

All of what you are trying to do can be accomplished with chmod, chgroup, or chown.
(*not enough rep to hyperlink >2 times)

This command above will keep the syncfile owned by owner, while giving group ownership to user. User group permissions must be set correctly with chmod for this to work. eg.

chmod 754 syncfile.foo

or

chmod 750 syncfile.foo

Where 754 gives +rwx to owner, +r-x to file group (user), +r to all others..
Or where 750 gives the same, but does not give all others read permissions.

|improve this answer
  • But how does the www-user invoke the script to update the file? If the www-user invokes the script themselves they won't have permission to write to the file. Basically the www-user should be able to trigger the update but not change what the sync process does or modify the synced file without running the sync process. – thexacre Dec 8 '14 at 7:47
1

(not so)Complete answer:

#chmod 1770 /directory/containing/syncfile.txts/
#chmod 1750 /directory/containing/syncfile.sh/
#chgrp www-user /path/to/syncfile.sh

chmod-
1:Sticky Bit (only owner may delete or modify)
7:deploy-user +rwx
7:group users (www-user) +rwx
0: Everyone else gets no read, write, or execute.

Setting the sticky bit on the second directory is redundant because only the owner will have modify permissions anyway, but why not.

chgrp-
Gives www-user syncfile.sh group ownership.

|improve this answer
  • If I understand correctly, the www-user could still overwrite the content of sync.txt even if they can't delete or move it? – thexacre Dec 8 '14 at 8:50
  • Incorrect, all files created in the directory with sticky bit set will inherit its permissions. i.e. files can be created by www-user, but once created, not modified. – cremefraiche Dec 8 '14 at 9:05
  • Then how will www-data invoke the sync script in future to update the file? – thexacre Dec 8 '14 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.