LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Default file ownership and ACL (https://www.linuxquestions.org/questions/linux-security-4/default-file-ownership-and-acl-719394/)

sbabcock23 04-15-2009 04:02 PM

Default file ownership and ACL
 
Hi

There is a bunch of directories and files that I have set ACL's too so that users can create, delete, modify files or simply just read them. However if they create a new file, the default ownership of the file by just doing ls -l is there username and default group. I want the default owner of the file to be root so that they cannot chmod 777 on that file. They will still have access to it because of the acls, i just don't want them giving access to everyone

grepmasterd 04-17-2009 01:07 AM

sorry, users cannot create root-owned files, nor files with any ownership but their own.

Quote:

They will still have access to it because of the acls, i just don't want them giving access to everyone
They can do this anyway on other parts of the system (their home dirs, /tmp, etc). I'm not sure I see the point of restricting it here.

tkedwards 04-17-2009 03:02 AM

Yeah, if a user has write access to a file then they can change the permissions (but not the ownership). It'd be better if you stated the problem you're trying to solve as I think you're looking at this the wrong way. If you have a group of users who work on a set of files that you don't want anyone else to have access to then put those users in a group, set the group ownership on those files to that group and finally set the setgid bit (chmod g+s).

There is no way to stop your users deliberately giving access to others to files that they can access. If they can write to the files they can change the permissions, if they can read them they can copy them to another part of the filesystem, a network drive, a USB drive etc. If you can't trust your users with important files don't give them access to them.


All times are GMT -5. The time now is 01:53 AM.