Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have three users:

  • user_1,
  • user_2, and
  • user_super.

There are two directories,

  • /root/user_1 (chown -R user_1:user_1)
  • /root/user_2 (chown -R user_2:user_2)

I want my user_super to be able to modify these files and be able to chown it back to original.

user_1 and user_2 cannot read/change each others files and are jailed to their root folders.

How do I go about that?

PS: user_super should have no root permissions, user_super will run apache on the server so, it should be as close as possible to www-data (Apache) user.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Set the group sticky bit (chmod g+s ) on a directory, so that newly created files inherit the group ownership and group permissions. It will help in case you are dealing with apache hosting and multiple ftp-users.

We circumvent this problem on our servers in apache vs. ftp-users by running apache with mod_itk and setting the vhosts to be run with ftp ownership permissions.

share|improve this answer

make a group supergroup with the user user_super in it, then

/root/user_1 (chown -R user_1:supergroup)
/root/user_2 (chown -R user_2:supergroup)

Problem with this setup: In most implementations, chown can only be executed by the superuser. Unprivileged (regular) users who wish to change the group of a file that they own may use chgrp. So you would think: perfect, I'll let user_super change the group back to group user_1 or user_2 but chgrp only lets user_super change ownership to one group of which he is a member.

I guess user_super is not root?

share|improve this answer
    
Thx for the answer. actually and ideally I would like to make my www-data (apache) user_super with minimum rights to do just that. –  Devrim Sep 8 '09 at 23:38

You could try using sudo.

Create entries in the sudoers file to allow user-super to take ownership of the files in /root/user-1 and /root/user-2 and also to give ownership back to user-1 and user-2.

Then, user-super would run the first sudo chown command, edit the file, and then run the second sudo chown command to change it back. Don't allow unrestricted sudo chown, but specifiy patterns.

When setting up a mail server, I needed to have apache create mailboxes that would be owned by the virtual mailbox process. so what I did was to create a small script that would create the script and then change ownership to the virtual mailbox process. I added apache to the sudoers file, allowing it to run the script. It works well, but in the interest of full disclosure, you will need to careful in your construction of the script, as security mistakes can be a dozy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.