Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an issue with some of my users misusing chmod by doing things like

chmod 777 ~ -Rf

I'd like to disable chmod so that only users with full sudo rights (I.E. IT) have rights. Are there any downsides to this that I might be overlooking?

Does apache or any other common part of linux require access to chmod that I'm overlooking?

Additionally, would the best way to do this just be:

chmod 700 /bin/chmod

Thanks!

EDIT:

To clarify, I know there are ways around it, and I know that educating my users is the right thing to do. But people don't always do what I tell them to do. Computers will... if I force my users to ask me before using chmod, I can educate them on why their rights were taken away, instruct them on the right way to do it, and selectively grant them sudo rights to chmod what they need to chmod.

At the same time, I'm hesitant to mess with one of the fundamental commands of a linux shell. What I'm asking is, does anyone know of any side effects I might be overlooking? I.E. when you create a file, does it call chmod to set the initial permissions, or is that unrelated? Does a file copy need chmod? Are there standard services that rely on chmod that might break if only root had access to chmod?

share|improve this question
6  
I think the better solution is to educate users on how permissions work, but that might just be me. –  ThatGraemeGuy Sep 14 '11 at 13:08
1  
Besides, if your users are knowledgable enough and you have a compiler on your system, they can just roll their own chmod. It may be that they're simply being lazy. –  Chris J Sep 14 '11 at 13:35
    
@Graeme Donaldson - I agree, but some users are very slow learners. There are definitely some users for whom I would like the option of just disallowing chmod. –  Dan R Sep 14 '11 at 14:04
    
@Chris J - my users for the most part aren't knowledgeable enough to compile chmod. And the ones who are would know how aren't the ones I'm worried about. –  Dan R Sep 14 '11 at 14:05

4 Answers 4

up vote 2 down vote accepted

Do you allow users to use certificates to SSH in? Or write scripts (shell, CGIs, etc?)

Without access to chmod, they won't be able to set the necessary permissions to make ssh certificates work (some people might see that an an advantage, but if that's the case, you should be editing pam.conf to disallow it entirely), they'd have to call the interpreter w/ the script as an argument (eg, perl script.pl), rather than the script directly, and a webserver will refuse to run their CGIs as the permissions aren't set correctly.

Depending on what the user's default group is, and how you have the default umask set up, it's also possible that files created won't be be readable by the webserver, and so can't be served at all, CGI or otherwise. Also, lack of chmod means that you can't correct problem permissions from files that were moved over via scp, which is permission preserving by default.

... giving the users sudo rights to chmod is possibly an even bigger can of worms -- as then they'd be able to run the commands as root, not as themselves, so they could affect the permissions of any user. You'd be better off making a 'chmodders' group, setting the permission on chmod to 0750, and add people to the group who are allowed to use it.

share|improve this answer
    
I use ssh certs to login, but I don't think many others do. If they want to do that, I can run chmod for them. no CGI issues, most of these systems those users aren't doing web stuff. I think the chmodders group is going to be my best solution. Thanks! –  Dan R Sep 14 '11 at 15:20

imho, this sounds like looking for a technical solution to a human problem.

share|improve this answer
    
Well... yes. Is that a bad thing? Some of my users are abusing a command, I've warned them not to, but they still do it. I think taking away their right to use that command is a perfectly valid option. If they have to ask permission a few times to do it, I can instruct them on what the right way would be, and give them sudo rights to that exact command. That way they would learn the right way to do it and earn their rights back. –  Dan R Sep 14 '11 at 14:13
    
not as such, sometimes you need a carrot and a stick and all that. You just have to be a bit careful because these solutions are often messy, avoid solving the root problem, and snowball from quick fixes to "thats how its always been done" headaches down the road. in my experience, at least. –  Sirex Sep 14 '11 at 20:57

If you still want to do this, you can do it by moving the binary file from /bin/chmod to some other path like /root/chmod.

To make the users think the tool is still available, you can create a script that does nothing in the original path under /bin.

This way you can disable the chmod tool unless you specify the full path /root/chmod.

share|improve this answer
    
Well, if I just run chmod 700 /bin/chmod then no one but root would be able to run it anyway. If I moved chmod to /root, the same would happen, but script that was counting on chmod being in /bin would break even for the root user. –  Dan R Sep 14 '11 at 14:17
    
You could also place a wrapper in /bin/chmod that will pass through to /root/chmod if either the user is root or in wheel, or they haven't passed permissions that you don't like. –  Joe H. Sep 14 '11 at 14:23
    
@Joe H. - Not a bad idea... but I think I could do the same thing by doing: chown root:wheel /bin/chmod ; chmod 770 /bin/chmod ; –  Dan R Sep 14 '11 at 14:26
1  
@Dan R: that would allow root & wheel, but wouldn't allow the other users to use it when they gave it sensible requests. (eg, chmod u+x ...) –  Joe H. Sep 14 '11 at 14:33

The cons are that chmod would not be available to any script that is run as non-root user which might break some things.

It is not clear what are your real requirements, but might look at this question and the solutions.

share|improve this answer
    
Neat idea, but I don't really want (or need) to restrict their commands that much. I just want them to stop chmodding everything 777 anytime they run into a permissions problem. If I can't get them to ask me the right way to fix something before running off and chmodding everything in sight, I think taking away their rights to that command is a good response. I'm just asking if there's anything that I might be missing in terms of the normal operations of a linux server that might break if I set /bin/chmod to 700 permissions. –  Dan R Sep 14 '11 at 14:17
    
if you put 700 on chmod then something might break, but not very much. most things that use chmod are used during installs which are run as sudo anyway. even things that depend on permissions don't like to mess with that themselves and opt to warnings. so not much should break... (not that I have done it) –  Unreason Sep 14 '11 at 14:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.