Skip to main content
Fix minor spelling error in TNW's edit; add example sudoers entry
Source Link
Toby Speight
  • 9.3k
  • 3
  • 32
  • 54

From the chown(2) man page:

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.

Your process is neither privileged, nor changing the group of a file it owns to a group the owner is in.

Therefore you will need to gain suitable privilege. The two easiest ways to do so are

  1. Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or even better, add CAP_CHOWN capability with sudo setcap cap_chown+ep <program_name>, which won't make the program run as root with all of it's consequences.

    Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or even better, add CAP_CHOWN capability with sudo setcap cap_chown+ep <program_name>, which won't make the program run as root with all of its consequences.

  2. Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password.

    Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password: write a line such as

     bar ALL = (root) NOPASSWD: /bin/chown foo:server '/full/path/to/file'
    

to a file in /etc/sudoers.d (and check that /etc/sudoers has a corresponding #includedir directive - most Linux distributions do). Make sure the command called by your script matches exactly!

From the chown(2) man page:

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.

Your process is neither privileged, nor changing the group of a file it owns to a group the owner is in.

Therefore you will need to gain suitable privilege. The two easiest ways to do so are

  1. Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or even better, add CAP_CHOWN capability with sudo setcap cap_chown+ep <program_name>, which won't make the program run as root with all of it's consequences.
  2. Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password.

From the chown(2) man page:

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.

Your process is neither privileged, nor changing the group of a file it owns to a group the owner is in.

Therefore you will need to gain suitable privilege. The two easiest ways to do so are

  1. Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or even better, add CAP_CHOWN capability with sudo setcap cap_chown+ep <program_name>, which won't make the program run as root with all of its consequences.

  2. Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password: write a line such as

     bar ALL = (root) NOPASSWD: /bin/chown foo:server '/full/path/to/file'
    

to a file in /etc/sudoers.d (and check that /etc/sudoers has a corresponding #includedir directive - most Linux distributions do). Make sure the command called by your script matches exactly!

From the chown(2) man page:

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.

Your process is neither privileged, nor changing the group of a file it owns to a group the owner is in.

Therefore you will need to gain suitable privilege. The two easiest ways to do so are

  1. Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or even better, add CAP_CHOWN capability with sudo setcap cap_chown+ep <program_name>, which won't make the program run as root with all of it's consequences.
  2. Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password.

From the chown(2) man page:

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.

Your process is neither privileged, nor changing the group of a file it owns to a group the owner is in.

Therefore you will need to gain suitable privilege. The two easiest ways to do so are

  1. Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or
  2. Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password.

From the chown(2) man page:

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.

Your process is neither privileged, nor changing the group of a file it owns to a group the owner is in.

Therefore you will need to gain suitable privilege. The two easiest ways to do so are

  1. Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or even better, add CAP_CHOWN capability with sudo setcap cap_chown+ep <program_name>, which won't make the program run as root with all of it's consequences.
  2. Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password.
Source Link
Toby Speight
  • 9.3k
  • 3
  • 32
  • 54

From the chown(2) man page:

Only a privileged process (Linux: one with the CAP_CHOWN capability) may change the owner of a file. The owner of a file may change the group of the file to any group of which that owner is a member. A privileged process (Linux: with CAP_CHOWN) may change the group arbitrarily.

Your process is neither privileged, nor changing the group of a file it owns to a group the owner is in.

Therefore you will need to gain suitable privilege. The two easiest ways to do so are

  1. Write a minimal binary program (probably in C) to set the ownership of that file (I'm assuming that the file's pathname can be hard-coded, to prevent abuse) and make it set-user-id to root, or
  2. Write a suitable /etc/sudoers entry to permit that particular command to be executed using sudo without a password.