3

I have created user, e.g. ronly, now I want to give them read only access to few directories on other user home like abc/,xyz/,pqr/ so I put this ronly user in others means not created any group for this user that means ronly will be others for above directories.Now everything work as per expectation but the only issue is that abc/,xyz,pqr/ have some shell scripts that ronly should read but NOT execute them.

The shell scripts having permission like this -rwxrw-r-- test.sh means user ronly can see the scripts but should not execute them, this work for only one way like executing shell scripts like ./test.sh this gives permission denied but with sh test.sh and /bin/sh test.sh can allow ronly to execute the scripts.

So is there any way by which I restrict them to execute shell scripts files?

Please do not suggest ACL or SElinux. I do not want to enable this due to some restrictions.

2

We can place validation at the beginning of script.

userid=`id -u -n`
#echo "$userid" ;

ownuser=`ls -l ${abosolutepath}/${your_script.sh} | awk '{print $3}'`
#echo "$ownuser" ;

if [ ! "$userid" = "$ownuser" ]; then
        echo permission denied
        exit 1
fi

Above validation will check if the user who executing this script is same as user who own this script. If user does not match, execution will be terminated.

I have implement this in my environment and it is working fine.

2

In general, this is not possible. Any user who is able to execute a shell is also able to execute any shell script they can read. The shell does not really distinguish between commands that come from the terminal and commands that come from a file.

So you would probably need some kind of restricted "shell". In principle, any program can be used as a login shell.

2

Without involving ACL or SELinux the only way I find is adding at the beginning of the script this:

if [ "$USER" = "ronly" ]; then
  echo 'Access denied'
  exit 1
fi

This is far from perfect because:

  1. The user ronly can read the script, so he can copy the contents to a script in his own home and execute it.
  2. Any user can freely set their $USER environment variable, e.g. set the USER variable to abc and execute the script, which will bypass the restriction.

If you are doing this only to avoid "accidental" executions then it works, but if your aim is to REALLY forbid the execution then it doesn't.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.