Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know this may sound strange, but I need to allow only scripts to write to a certain file.

The file is owned by root, and some users have sudo or root access. They sometimes edit the file by hand, but this is wrong, because there are some scripts that edit the file correctly (while such users do it incorrectly).

So, I'd like that only those scripts have the right to edit the file, while any user can't edit, but only read that file.

Is it possible to do something like this? I know this is silly because they have admin rights, but, at least I'd like to make it hard to edit the files by hand... The scripts can be modified, of course, so if it's possible to obtain a "script-only access token" which grant the write access to such file, the scripts can be changed accordingly.

share|improve this question
    
Thanks for the feedback so far about the immutable bit, but I thought that having a more general strategy that doesn't involve editing the scripts would be even better and more usable, so I'll wait a bit if someone comes up with another solution of that kind. –  AkiRoss Jan 3 '13 at 18:36
add comment

3 Answers

Since your "some users" have sudo or root access to the machine, it is not fully possible. Because every thing you doing as root can revert by them. So, the only thing you can do is attributing. So it makes them some difficulty to modify the files, but still its not fully proof because of the same reason I mentioned in first sentence.

Using following command you can set attributes to file:

chattr +i /path/to/file

where +i mean immutable. So no one can edit the file without removing attribute. So in you script you do like following:

...
chattr -i /path/to/file # remove the immutable attribute of the file at the beginning of your script
...
...
...
...
chattr +i /path/to/file # attribute the file at the end of your script

Examples :

http://www.cyberciti.biz/faq/linux-write-protecting-a-file/

http://www.cyberciti.biz/tips/linux-password-trick.html

share|improve this answer
    
Thanks, it's good to know about the immutable bit. I'll think about it some more to see if helps. –  AkiRoss Jan 3 '13 at 18:32
add comment

If they have root access, all bets are pretty much off..depending how savvy they are. One ugly way is to set immutable bit on your file. It will be unmodifiable as long as that attribute is set. Then change your scripts to remove that attribute before updating your file and set it back afterwards. Hopefully your users won't notice that attribute and their attempts at editing will be futile.

And obviously, the biggest thing is user education. We shouldn't ban hammers because idiots keep smashing their thumbs ;)

share|improve this answer
add comment

Have the script make the first line of the file

#### WARNING:  THIS FILE IS GENERATED AUTOMATICALLY.  DO NOT EDIT BY HAND

As others have noted, if they have root, you can't stop them.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.