Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In Unix, Can I own a file that I cannot read?

If so, How can I do it?

share|improve this question
add comment

migrated from stackoverflow.com Sep 19 '12 at 3:02

This question came from our site for professional and enthusiast programmers.

3 Answers

The answer is yes, you can unset the read-flag for your file. But as a owner you (and a program running with your rights) can set the flag again. but for a program that does not do it automatically, you can forbid read-access this way.

share|improve this answer
add comment

Assuming your file is called file_name, try

chmod a-r file_name
share|improve this answer
add comment

This is probably impossible to do it portably (POSIX). However, if you are running Solaris 10 or newer, here is a way to prevent a user to persistently set the permissions on a given file using a dtrace script.

#!/usr/sbin/dtrace -qws
BEGIN {
        userid=$1;
        filename=$$2;
        fullpath=$$3;
}
syscall::chmod:entry / strstr(copyinstr(arg0), filename) != NULL  && uid == userid /
{
        self->flag=1
}
syscall::chmod:return /self->flag/
{
        system("chmod 0 %s;echo gotcha",fullpath);
}

You need to run it as root (or a user having sufficient privileges to run dtrace) and pass three parameters to the script: the target userid, the (base)name of the file to protect and its full path.

e.g.

# ./protect.d 53391 special /var/tmp/a/special &

On a second window, here is a sample session showing the dtrace script result:

$ id
uid=53391(jlliagre) gid=53391(jlliagre)
$ cd /var/tmp
$ ls -la a
total 12
drwxr-xr-x   2 jlliagre jlliagre       4 Sep 18 22:45 .
drwxrwxrwt  13 root     sys           48 Sep 18 23:36 ..
----------   1 jlliagre jlliagre      30 Sep 18 23:05 b
----------   1 jlliagre jlliagre      30 Sep 18 23:05 special
$ cat a/b
cat: cannot open a/b
$ chmod a+r a/b
$ cat a/b
Tue Sep 18 23:05:39 CEST 2012
$ chmod a+r a/special
$ cat a/special
cat: cannot open a/special

Of course this is kind of a hack, isn't at all representative of what dtrace is designed to allow and has certainly race conditions and other deficiencies to be completely reliable but is anyway a method to achieve what you want.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.