From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1RdoPl-0006xw-79 for garchives@archives.gentoo.org; Thu, 22 Dec 2011 19:34:53 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id B706521C1F1; Thu, 22 Dec 2011 19:34:43 +0000 (UTC) Received: from homiemail-a44.g.dreamhost.com (caibbdcaaaaf.dreamhost.com [208.113.200.5]) by pigeon.gentoo.org (Postfix) with ESMTP id 0ABB621C090 for ; Thu, 22 Dec 2011 19:33:39 +0000 (UTC) Received: from homiemail-a44.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a44.g.dreamhost.com (Postfix) with ESMTP id 69DBB118064 for ; Thu, 22 Dec 2011 11:33:39 -0800 (PST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=libertytrek.org; h=message-id :date:from:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; q=dns; s= libertytrek.org; b=fnq5vh0Po9dO2AlSxIC2RWOsThQ6I52iz1LhL3jPHrbgk j6vtwajSMVZ/qQ4jYJJjnYKxouyVHgZqoWmqyxn5NIvRh4HWAmsclLnh6g7pQxxy UwNdOjQluxql/XgpZ05CBEwbLeg/vtQjqpfx8e8sIB/DmjLZmo5kz6xvu5ZTfk= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=libertytrek.org; h= message-id:date:from:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; s= libertytrek.org; bh=vKXpdZAkQmWIFTaHhe8D8k2vba8=; b=T+wfeRhdVSv9 yQi6xMT33ikKNxohodpV9Jf/GieQCbafIJC0rSx/CIJ4bGhRm2SQ2wDIo3tzzt+R VdQVYl4gAtqudgrGu1srb4HhZgMRVrRh2FaLhkFAA5u47yrG8AEQupGwWAI+VS1l VR8ViD9GtsT7OaEAeGWeE+Y4Kad+fkI= Received: from [127.0.0.1] (smtp.media-brokers.com [70.43.81.99]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: tanstaafl@libertytrek.org) by homiemail-a44.g.dreamhost.com (Postfix) with ESMTPSA id 30BA2118058 for ; Thu, 22 Dec 2011 11:33:39 -0800 (PST) Message-ID: <4EF3861B.7000403@libertytrek.org> Date: Thu, 22 Dec 2011 14:33:47 -0500 From: Tanstaafl User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0) Gecko/20111220 Thunderbird/9.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Re: Allow non root users to edit files owned by root? References: <4EF0A415.8020007@libertytrek.org> <4EF3506B.5020802@libertytrek.org> <4EF37CB7.1080400@libertytrek.org> <20111222212107.2fcfba70@rohan.example.com> In-Reply-To: <20111222212107.2fcfba70@rohan.example.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Archives-Salt: 171d73b8-aa1d-4850-a578-4cbac455ef36 X-Archives-Hash: 4f7a8530e0523f268170648553448cab Thanks for the explanation Alan... have to do some reading/studying on this. Any good pointers for best practices for this kind of thing? Thanks again... On 2011-12-22 2:21 PM, Alan McKinnon wrote: > On Thu, 22 Dec 2011 13:53:43 -0500 > Tanstaafl wrote: > >> On 2011-12-22 1:00 PM, Nikos Chantziaras wrote: >>> On 12/22/2011 05:44 PM, Tanstaafl wrote: >>>> On 2011-12-20 12:19 PM, Nikos Chantziaras wrote: >>>>> If you allow someone to edit root owned files, you're practically >>>>> giving him root access. >>>> >>>> Well, yeah, but only on those defined files... >>> >>> root access is global. You can't limit it. root is root, the all >>> powerful Unix being. Period :-) >> >> Ummm... then what is the purpose of sudo?? > > The purpose of sudo is to provide *fine-grained* control of elevated > privilege to users and groups. Few people seem to realize just how > finely this can be controlled, most assume that sudo lets you become > root and that's it. > > As with all things fine-grained, it can get very complex very quick. If > you want to allow 5 commands to operate on 5 files, you have to make 25 > allow statements (unless you can use some funky wildcard syntax). > > >> >> If I add the following line to sudoers: >> >> %sudoroot >> ALL=(root)NOPASSWD:/bin/chmod /var/www/localhost/htdocs/* >> >> Are you saying that this does NOT limit anyone in the sudoroot group >> to *only* be able to run the chmod command, and only on files located >> in /var/www/localhost/htdocs? > > Not quite, take out the word "only". When you say only, you exclude > everything else and that is not true - you might have a second set of > permissions somewhere else. The line you quoted does exactly what > you said without the word "only" - it allows the action. Different > commands and different files are outside the scope of that config line > >> >>> Then you put the files in a special group and make them g+w, and >>> add the affected users to that group. Then they will able to write >>> to those files. If you want to give them write access to a whole >>> directory, you put the directory in the group and make it g+w. This >>> is how it's traditionally been done in Unix for ages, and it's >>> extremely easy to set up. >> >> Yeah, I think I got a little tunnel vision trying to do this with >> sudo. > > Permissions and right of access is hard. Few people know how to do it > right, and you can't consider just sudo in isolation. > > sudo is one command in a whole system and you have to take that into > account too. The method you use will depend more on everything else > that machine can do than just on what sudo you can do. > > If you need to allow just one single user to access just one single > directory, you are better off with using Posix ACLS (NOT regular > owner, group and perms - that almost never works out right for www data) > > If you have many different users needing all sorts of different access > to things, you might even consider SE-Linux. Just be prepared for huge > amounts of customizing. But if it really is what you need, SE Linux is > worth the sweat. > >