Preventing a file edit by users on linux

Question

I know this may sound strange, but I need to allow only scripts to write to a certain file.

The file is owned by root, and some users have sudo or root access. They sometimes edit the file by hand, but this is wrong, because there are some scripts that edit the file correctly (while such users do it incorrectly).

So, I'd like that only those scripts have the right to edit the file, while any user can't edit, but only read that file.

Is it possible to do something like this? I know this is silly because they have admin rights, but, at least I'd like to make it hard to edit the files by hand... The scripts can be modified, of course, so if it's possible to obtain a "script-only access token" which grant the write access to such file, the scripts can be changed accordingly.

Answer 1

Since your "some users" have sudo or root access to the machine, it is not fully possible. Because every thing you doing as root can revert by them. So, the only thing you can do is attributing. So it makes them some difficulty to modify the files, but still its not fully proof because of the same reason I mentioned in first sentence.

Using following command you can set attributes to file:

chattr +i /path/to/file

where +i mean immutable. So no one can edit the file without removing attribute. So in you script you do like following:

...
chattr -i /path/to/file # remove the immutable attribute of the file at the beginning of your script
...
...
...
...
chattr +i /path/to/file # attribute the file at the end of your script

Examples :

http://www.cyberciti.biz/faq/linux-write-protecting-a-file/

http://www.cyberciti.biz/tips/linux-password-trick.html

Answer 2

If they have root access, all bets are pretty much off..depending how savvy they are. One ugly way is to set immutable bit on your file. It will be unmodifiable as long as that attribute is set. Then change your scripts to remove that attribute before updating your file and set it back afterwards. Hopefully your users won't notice that attribute and their attempts at editing will be futile.

And obviously, the biggest thing is user education. We shouldn't ban hammers because idiots keep smashing their thumbs ;)

Answer 3

Have the script make the first line of the file

#### WARNING:  THIS FILE IS GENERATED AUTOMATICALLY.  DO NOT EDIT BY HAND

As others have noted, if they have root, you can't stop them.