RHEL5 Setuid Question

frndrfoe · 09-07-2010, 12:06 PM

Could you setup the multi user area as a subversion repo and do a post commit hook to check out a copy to an area that is only accessed and owned by the application?

This is assuming that I understand the problem correctly: The application must _own_ the files

perhaps I am skinning a yak at this point.

MensaWater · 09-07-2010, 12:39 PM

Quote:

Originally Posted by epoh

No, you've got it. What you've put is what I am currently doing. I've got a cronjob that runs every 30 seconds that chowns everything. The issue is that periodically they will get errors because their app will try to read the directory before the chown script has run. I was trying to see if there was a better way to handle it, but it doesn't look like it. (Except maybe getting SAP to let me look at the code of the app they are running!)

So long as the application owner ID (e.g. sapadmin) and all your individual users (e.g. bob, sue, tiny, bertha) are members of the group that you put sgid on the directory and you also have read, write & execute bits set for group on the directory there should be no reason the application can't read the files created by the individual users. Remember that users can be members of multiple groups so you don't have to add the app owner to the users group and don't have to add the users to the app owner's group. Ordinarily the file would get that default group from the user but the sgid overrides it to use the group that currently is group for the directory.

frndrfoe · 09-07-2010, 12:59 PM

MensaWater is correct,
I was just thinking "in a strange circumstance" similar to sendmail wanting it's certificate's key to be owned by sendmail and not readable by anyone else (which isn't strange).

You may also have problems if you do not change the user's umask because I think it will default to 022.