2

i'm a web developer and i need to run some third-party programs on my server. Since these programs are third-party and i'm not always 100% sure of their reliability, i would run these programs with specific permissions. Since these programs will need to write file to disk, i want to set up permissions to deny access to the entire hard disk (i dont want even read-only), except for one directory where these programs will write into. I thought that the easiest way to achieve this is:

  • create the group "third-parties"
  • create the user "third-parties-user"
  • deny access to the entire hard disk (even not read-only) to group "third-parties"
  • allow read-write into /var/example/thirdparties
  • set "third-parties-user" as the owner of the programs i have to run
  • write a cronjob under "third-parties-user" to start programs at startup (something like @reboot sh /var/example/thirdparties/run-all-thirdparties-programs.sh )

My question is..technically talking, how can i create those group/user and set up permissions? if i run a program owned by specific user, will that program inherit permissions from his owner group/user? i'm completely new in Ubuntu Server..

Also.. if anyone has a better idea to reach my goal, i have big ears :) thanks

Improve this question
5
  • FYI: That's the standard proceedure on *NIX systems - don't trust something you don't have to. You only share group privileges (by adding multiple sytem users running the services to a group) if necessary (e.g. if you would want a service to use dovecot's SASL authentication). upstart runs as user root and privileges don't need to be dropped to a specific uid/gid, but can be dropped to individual uids/gids per service. Ubuntu 15.04 runs systemd, so you might want to write systemd scripts rather than (not too) soon to be deprecated upstart scripts.
    – Kalle Richter
    May 4, 2015 at 14:30
  • Sorry but your answer it's not so clear to me.. as i told, im new in Ubuntu server. Also, i'm going to run all with 14.04 LTS server . With upstart you meant the cronjob "@reboot"? thanks for your interest
    – Jhon Zunda
    May 4, 2015 at 14:34
  • @JhonZunda those apps are web-based or local?
    – Maythux
    May 4, 2015 at 14:38
  • It's not an answer, but a comment. I read upstart, but you wrote startup and thought you already know it. Make yourself familiar with systemd or wait for a detailed answer.
    – Kalle Richter
    May 4, 2015 at 14:39
  • @KarlRichter ok thanks for your link, im going to make me familiar, still waiting for a detailed answer. NewUSer those apps are local.. they basically are API client.. they will take some values from outside the server and then write them (the values) locally.. i need to keep them always open.
    – Jhon Zunda
    May 4, 2015 at 14:45

1 Answer 1

Reset to default
0

The standard permission system in Linux does not support well the use case that you are describing (for example "deny access to the entire hard-disk"). A better approach would be to try using chroot or docker, to make sure that the program runs in an environment that is isolated from the main system.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .