Wednesday 3 July 2013

How to Permitting read-only access to a shared file via sudo

Problem: Two or more users want to share a file, some read/write and others read-only.
 

Solution: Create two linux groups, one for read/write and one for read-only users:

/etc/group:
readers:x:300:r1,r2,r3,r4
writers:x:301:w1,w2,w3

 
Permit the writers group to write the file via group permissions:

# chmod 660 shared_file
# chgrp writers shared_file

 
Permit the readers group to read the file via sudo:


/etc/sudoers:
%readers ALL = (w1) /bin/cat /path/to/shared_file

Note: If a file must be writable by a group of teaching assistants but read-only to a group of students. if there were only two users-one reader and one writer - you could dispense with groups and simply let the reader access the file via sudo.

if smith is the reader and jones the writer, and we give smith the following capability:

/etc/sudoers:
smith ALL = (jones) NOPASSWD: /bin/cat /home/jones/private.stuff

then jones can protect her file:

jones$ chmod 600 $HOME/private.stuff

and smith can view it:

smith$ sudo -u jones cat /home/jones/private.stuff


No comments:

Post a Comment