Supouse I have a directory /opt/expe and I want any user to create .txt files on it. I want any user to type something like this:

$ whoami
$ export $file_name=my_txt_file
$ /opt/expe/create_file.sh
$ ls -cal /opt/expe
total 12
drwxr-xr-x 2 root  root 4096 Jul 29 19:27 .
drwxr-xr-x 6 root  root 4096 Jul 29 19:14 ..
-rwsr-sr-t 1 root  root   65 Jul 29 19:29 create_file.sh
-rw-r--r-- 1 user1 root    0 Jul 29 19:27 my_txt_file.txt

I try this with a sudoer

$ whoami
$ cat /opt/expe/create_file.sh
touch /opt/expe/$file_name.txt
chown $USER /opt/expe/$file_name.txt
$ chmod a+x /opt/expe/create_file.sh
$ chmod a+t /opt/expe/create_file.sh
$ chmod a+s /opt/expe/create_file.sh
$ chmod a+X /opt/expe/create_file.sh

Then with non-root user I obtained:

$ whoami
$ export $file_name=my_txt_file
$ /opt/expe/create_file.sh
touch: cannot touch '/opt/expe/prueba_txt.txt': Permission denied

Can I do something like this. I want something like postgres SECURITY DEFINER concept.

  • Are all the users in the same group? chmod 775 /opt/expe or chmod 777 /opt/expe. Why should I learn about "postgres SECURITY DEFINER concept"? What parts of it do you need? – waltinator Jul 30 '17 at 0:14
  • Can you please post output of ls -ld /opt/expe ... – Pawel Debski Jul 30 '17 at 10:07

I am not familiar with Postgres enough, but I see at least 4 options:

  1. Change permissions of /opt/expe with chmod to allow all users create files within this directory.

  2. Create a separate group for the users which need to write there and change /opt/expe group permission with chmod to allow this group write there.

  3. Create a separate group and add sudoers rule to let them execute this script as described for example here: How can user mount an encrypted file container in VeraCrypt?

  4. Use label security for fine-grained access control. Here is brief description of security labels and some further links: https://unix.stackexchange.com/questions/53028/what-are-ext4-security-labels

Please bear in mind that the permission to create/remove files is a property of the directory and not the file itself.

  • Options 1 & 2 are not what I ask. Option 4 is interesting but I don't found an answer in it. Option 3 looks like I need, I try something but it doesn't works. Here Is my refined question: askubuntu.com/q/941273/672702. I hope thats the way. If it was, the option 3 is the path to the answer. I don't know yet. Thanks – Emilio Platzer Jul 30 '17 at 16:23
  • I see it's harder than I thought. Here are more info: es.stackoverflow.com/a/92856/184 – Emilio Platzer Aug 5 '17 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.