Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to create users that are subordinate to another user in Linux. By this I mean I want the superior user to be related to the subordinate users in two ways:

  • The superior user must be able to access all files of subordinate users with the same permissions they have
  • The superior user must be able to su to these subordinate users without entering those users passwords, similar to how root can su to any user that has a login shell

Is this possible? If so, how? I know I can manage the first thing with groups, but the second is actually the more important one.

I've been searching around a bit for a solution but I haven't been able to find one. I'm not sure if that means it can't be done/is really obscure or I just don't have the right words to put to it.

share|improve this question
    
I think PolicyKit should help with the second. I'd look at SELinux though, rather than mucking around with groups. –  Ignacio Vazquez-Abrams Sep 7 '13 at 1:59
    
Would sudo work? –  Scott Sep 7 '13 at 3:01

1 Answer 1

up vote 1 down vote accepted

The first part – file access – is generally impossible on plain Linux. You can do some things with groups or file ACLs, but there is nothing stopping the file owner from using chmod to make their own files private.

There is no such thing in Linux as "X is subordinate of root therefore root can access files of X".
Instead, root simply has the "override all permission checks" capability (cap_dac_override). That's all.

However, it might be possible to write a LSM that does this – the kind of module that SELinux or SMACK use... Or you could simply use su <subordinate_user> and read their files that way:


The second part is possible by writing custom sudo rules or special PAM configuration for su (although unfortunately I don't know of any existing PAM modules that would help).

For example, if you wanted to allow user X to run sudo -u Z -s (equivalent to su Z), the rule would be:

X    ALL=(Z) ALL

You can also use %groupname to specify a Unix group:

superiorguy    ALL=(%subordinates) ALL
share|improve this answer
    
Changing the sudoers file did it. I can live without the file permissions since I can just allow my user to act as another without a password. Thanks! –  Dylan Sep 7 '13 at 16:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.