How to make a non-root user to use chown for any user group files?

Question

I would like to make a user super powerful, with almost all root rights but unable to touch a the root user (to change the password of the root).

My goal is to user "B" to manage my web server. The problem is user B need to able to run the chown and chmod commands on some files belonging to other users.

I tried to put B in root group or use visudo, but it's not enough.

I'm working an Centos 6 system.

If some body have ideas!

Answer 1

Ideally no one would want to give root-like privileges to non-root users. What exactly are you trying to achieve here..? Why does user "B" need to change the ownership and privs of those files belonging to other users?

Well if this is all you want to achieve why not allow read access to those files and have user "B" simply copy them to another location. This will make user "B" the owner to the files and also allow for changing the privileges.

Another work-around is to use sudo so that they could run commands as root.

Answer 2

You best bet is to use an appropriately configured /etc/sudoers file.

If you want bob to be able to change the permissions and owners on the files of users fred, joe and sara, put this in your sudoers file. With this line, bob will need to use e.g. sudo -u fred chmod ... to change the permissions on fred's files.

Runas_Alias  USERS = fred, joe, sara
bob          ALL = (USERS): /bin/chmod, /bin/chown

Answer 3

They should be able to manage the web server content without chown. You may want to add them to the same group as the web-server runs as. Then chown the content to the desired user. It helps to set the group sticky bit on the top level content directory.

Generally, it is better if the web server can NOT write the content directories. The one exception is cache and upload directories that the web server uses.

Another approach I have used is to have a regularly scheduled task which updates the content from a version control repository. This works well when multiple users are updating content. Depending on the version control software you can handle chmod on check-in or after check-out. See What version control system can manage all aspects? for some ideas.