CODEWITHSUNDEEP
clinuxunix
bobby
bobby

Reputation: 305

Can we change permissions from user to root?

I have a written a C program that creates a file "abcd.txt" and write some data into it. I was executing my code by logging with a username"bobby" and so the file abcd.txt was created with owner as bobby.

But my task is, even though I execute my code with some username "bobby", the file should always be created with owner as root. Can someone help me by saying how this could possible?

Upvotes: 1

Views: 838

Answers (3)

Ahmed Masud
Ahmed Masud

Reputation: 22402

As a general principle you need your effective uid (euid to be root) either when you are are writing the file or when you perform a chown(2) on the file.

If you are doing this under Linux then there are linux specific methods that you can use.

Generic Solution

Without availability of sudo

This is the old UNIX DAC approach, it's fraught with peril. It assumes that you do not have something like sudo installed or cannot install it.

Your executable should be owned by root and have the executables setuid bit set.

Process

You should use seteuid () to drop your privileges from root to bobby for most of the operation, including writing. When you are done, bring your privilege level back up to root using seteuid(0) and perform a chown() (or fchown on the fd) on the file to change its ownership to root.

some basic safety

For safety set it up so that your executable is owned by root:safegrp where 'safegrp' is name of a group unique to users who are allowed to execute this file (add bobby to safegrp) ; and ensure that the setuid executable's mode is 4510 ;

With availability of sudo

If sudo is available on your system then follow the same process as above for dealing with privileges within the executable but DO NOT set the file mode to setuid, have safegrp added to sudoers for this executable and now bobby can run it with sudo /your/bin/prog

Linux specific solution

POSIX.1e

It is possible to have tighter control over the file use POSIX.1e capabilities support. In your case you wish to grant SYS_CHOWN to your program;

For security reasons, I would probably set that up as a COMPLETELY separate binary or a sub process and still use sudo and perform appropriate dropping of privileges.

linuxacl[ACL Using Access Control Lists on Linux] has excellent tutorial on this topic

SE-Linux

You can use Mandatory Access Control to limit the access to such a dangerous binary but SE linux is a pain to configure :^) although a possibly a good approach

Upvotes: 4

Erik Nedwidek
Erik Nedwidek

Reputation: 6184

Use the chown() method. There are probably more authoritative links, but this one is nice since it includes the calls to getpwnam(). I've done all of this in the past, but unfortunately I don't still have the code (it's owned by IBM).

http://manpages.courier-mta.org/htmlman2/chown.2.html

Upvotes: -1

Nicholas Wilson
Nicholas Wilson

Reputation: 9685

You probably don't want to run your program as root, unless you really have to. Perhaps run "chown" from a shell script after running your program? Or, you can use chown(2) from a program running as root (or with equivalent capabilities, on linux).

Upvotes: 0

Related Questions