Inspite of having 755 permissions on the chown command, it seems the command can be executed by the root only. I was under the impression that the 'x' permission for 'others' can give executable rights to the normal user too, which does not seem to be the case here.

Just curious to know, if not the file perms itself, what controls the execution of the command?

What is the error you're getting when you attempt to execute the command?

It has nothing to do with who can run the chown executable. Only root can change the owner of a file. You can't even give away your own files.

1 members found this post helpful.

This makes sense.

If you think a bit you would see that if a user could change the owner of a file it will create some security issues.

Think of someone writing a rootkit, virus or some malware and then put it on a public area. So far so good, but what will happen if it changed the owner to, lets say the worst case, the root user. If for some reason a Sys Admin ran that file, well... i think you can figure it out .

I think thats why the chown or chgrp only allow the root user to change the owner and group of a file.

Regards,

Thanks for the replies...
I asked this because, i am writing a script to audit a system, and want to make sure that no one but root has rights to run the chown command. While checking this, i thought it would be good idea to check if the default behavior has been changed, and a non-privileged user has been given the rights to run it. Is there _one place_ i can check this? or is it absolutely impossible to change the behavior?

Hi,

After a more careful reading of some previous postings and manuals, i see that you might be able to change that behaviour, but for that you need to change some POSIX settings. You need to disable the _POSIX_CHOWN_RESTRICTED, and for that you only need to add the following to /etc/system:
set rstchown = 0

For some distributions that file doesn't exist, but you can find it on /etc/sysctl.conf or /etc/sysctl.d/10*something

You can also check if this flag was been changed by issuing the command
sysctl -a | grep chown

and if you don't get any results or the result is something like
fs.*.chown = 1
that means everything is how it should
but if you get something like
fs.*.chown = 0
this means the behavior has been changed.

Regards,

2 members found this post helpful.