How to pass a file from one user to the other (without of creating any copies of it)?

Question

Suppose user "qqq" have file /home/qqq/bigfile.dat and want to pass it to user "aaa" without help of root (it need to be owned by "aaa"). What should users "qqq" and "aaa" do?

Naive way:

1. uid=qqq$ mv bigfile.dat /home/aaa/
2. uid=aaa$ chown aaa /home/aaa/bigfile.dat # Operation not permitted

Of course it can be done by using ACLs (uid=qqq$ setfacl u:aaa:rw- /home/aaa/bigfile.dat) or by making temporary copy (uid=aaa$ mv bigfile.dat bigfile.dat_ && cat bigfile.dat_ > bigfile.dat && rm bigfile.dat_), but both ways seem to have disadvantages.

Both users agree (can issue some command) to "pass" the file. It should be quick, preserving inode and other attributes etc.

How to do it cleanly?

Answer 1

Old unix systems allowed any user to chown their own files to any target. Most no longer do, because this created some security problems:

• If there are disk usage quotas in place, user A could store files on user B's expense by putting them in a private directory. User B would never know except by comparing their visible disk usage with their quotas, and would have no way to find the quota thief.

• Some privileged programs (set[ug]id executables or daemons) assume that if a file is owned by a user, that user has approved the content. If user A could chown a file to user B, A could trick the privileged program into accepting any data. (This is an insecure design anyway, because even if A has actually written the file, A might not have approved it for this particular purpose; but such programs do exist, and forbidding chowns does reduce the risks.)

• A chown by a non-root user cannot be undone. Mind, it's a risk you might live with (and in fact there are other things that you can do on a unix filesystem that can only be undone if some other user cooperates).

As far as I know, it is impossible to change the ownership of a file on most modern unix systems without root's cooperation. Root could perform the chown or give A or B the permission to do it via sudo, but that requires more targeted root intervention than is usually desirable.

If ACLs are enabled, as you've noticed, that gives most of the practical effects of chowning.

If the workflow really requires A to be the owner at some point and B to be the owner at some other point, there are other options you could explore.

• B might use fakeroot to run a program and make it believe it is running as root, which allows a simulated chown that exists only in fakeroot's memory (fakeroot sh -c 'chown B file; su B -c program').

• You could play tricks with FUSE. For example bindfs lets you create a view of a directory tree where files have a different owner (mkdir view_for_B; bindfs -u B actual_directory view_for_B).

Answer 2

Can you move the file to some shared space that both users have write access to (or does that sort of thing not exist on Linux?), and then have the owner chmod it to the receiver?

My mindset is rooted in Mac OS X, so that may or may not work for you.

Answer 3

It depends on what you mean by "without help from root". If you can get root to add aaa and qqq to some new group (any name will do) and make sure the file has at least r-- perms for the new group... (it can retain rwx for user aaa - so you get => aaa:newgroup rw-r----- ) then without FURTHER help from root aaa can modify and qqq can read the same file.

If you want to do it "against the wishes of root" then I'd consider it a bug if you found any way that works. Lots of thought went into preventing this because it's a security problem if aaa can put a trojan into a directory that qqq has access to and might "accidently" then run.

Answer 4

Ok, it's really cheeky but you could do:

aaa$ nc -l -p 12000 > bigfile.dat
qqq$ nc 127.0.0.1 12000 < bigfile.dat

Or

aaa$ mkfifo /tmp/gimme
aaa$ chmod a+w /tmp/gimme
aaa$ cat /tmp/gimme > bigfile.dat
qqq$ cat bigfile.dat > /tmp/gimme

If you want to do it without needing enough space for 2 copies of bigfile.dat, you could use split and write a loop to send 1 chuck at a time and then rm it straight away.

The main issue is of course that someone else could do a nc or an echo and corrupt your file.

Answer 5

One way to do this would be to create a ssh-key which allows user qqq to connect as aaa. As qqq do

ssh-keygen -t rsa

and decide if you want to go for passwordless key or not.

Then add the newly created key to aaa by running this as qqq:

ssh-copy-id -i ~/.ssh/id_rsa.pub aaa@localhost

After that you could move files around like this:

scp bigfile.dat aaa@localhost:

(or with your favourite sftp client)

That way sshd would take care of changing the ownership.

Using scp/sftp for local transfer might sound strange, but at least that works! :)