I have a Windows user on my network who has Samba access to our linux development server. Occasionally permissions or ownership will become confused for reasons unknown and he will no longer be able to edit files.

To get round this I have given him access through PuTTY and in the sudoers file (sudo visudo) I have added a line like this:

username ALL = /bin/chmod, /bin/chown

Now obviously he could now just chown everything to himself and delete the entire drive. He is trustworthy, but I worry if someone were to compromise his account or he accidentally got out of his depth and did it.

Is there a way I can restrict his account so it can only chmod or chown in /home/username and /specified/directory?

I am running Ubuntu 10.10 on the server.

  • Sounds like another option would be to fix the permissions problems in Samba. – Alex Holst Feb 2 '11 at 20:01
  • The settings are currently set to 775 so I am not sure what more I could do to fix the problems in Samba. Any ideas? It might not even be Samba that is causing the problem. – Treffynnon Feb 2 '11 at 20:08
  • @grawity What do you mean? sudo chown changes the ownership. – Treffynnon Feb 3 '11 at 8:43

You could write a script /usr/local/bin/permchange


chown -R youruser:yourgroup /home/username 
chmod -R u+rw /home/username
... etc

and allow him to run only this with sudo after making sure he can't edit it.

  • sudo will also restrict arguments, so the sudoers file could have the specific arguments listed in this script, and all would be well. – beans Feb 2 '11 at 18:55
  • This was my next course of action, but I thought I might have missed a simple trick in a config somewhere and didn't want to reinvent the wheel if I could avoid it! :) But thinking about it now this would make it easier for him as well because he doesn't have to learn any linux commands. – Treffynnon Feb 2 '11 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.