1

In Linux system, assume that there is user 'A' (non-root user who has ssh login permission).

'A' owns an executable file "A.out".

I want to allow 'A' to read/execute "A.out"

However, I don't want 'A' to change permission of "A.out"

as a root user, how can I enforce this?(in Ubuntu server)

thank you in advance.

1 Answer 1

3

The only two ways you can enforce this are:

  1. Change the file's owner to root or another user.

  2. Use SELinux/AppArmor/SMACK to deny the chmod usage.

4
  • Just to add, when/if you do change file's owner to root, make sure that "userA" has read-only access to file by being in group-owner group of file.
    – ek9
    Jun 11, 2014 at 7:10
  • @edvinas.me: Or by being in the file's ACL. Jun 11, 2014 at 7:12
  • it seems that if the owner of 'A.out' is root and group of 'A.out' is 'A' and if I give the permission of 'A.out' ---r-x---, it works as I want. A can RX the file 'A.out' but cannot change the permission. Am i right?
    – daehee
    Jun 11, 2014 at 7:19
  • I'm not really sure, but isn't it an option to set the file as immutable? (I.e. chattr +i A.out). Only superusers can do this and the file will be read-only. The user would still be able to set write permissions but cannot write to the file. Aug 22, 2017 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .