0

Sorry for my expressions, and I hope I've described my question as clearly as possible.

Using Red-hat system. Currently I own a superuser in the system, and I have to dosudo python cuckoo.py in order to run this python program, and it reads & writes in a specific directory, called "cuckoo".

Now I want to give a normal user access to this "cuckoo.py", as well as the working directory. However meanwhile I also don't want to grant this user superuser privilege because they may damage my system.

So how can I let the normal user just directly call python cuckoo.pyand won't receive any error saying "Permission Denied"?

Any help and comments are appreciated. And if I have some really bad word phrases to make it unclear, please point it out as well and I will do my best to explain in more details.

Thanks!

EDIT: Maybe my words are not quite clear... I don't want to include this normal user in "root". Currently I've created a group and have added this normal user into the group, and the directory permission is set to be 755. But I want the group to have the permission to write in order to run cuckoo.py smoothly. So I wonder how to make both root and this group have permission for read, write & execute?

  • Does the cuckoo.py script really need to be run as root have read/write access to the directory? – Julie Pelletier Jun 21 '16 at 6:30
  • @JuliePelletier I added the normal user to the group and the group has the permission to execute, then he can do "python cuckoo.py" without calling sudo. But because the group can't write, so this program won't be run successfully. Not sure if this answers your question? – Xiechen Jun 21 '16 at 20:27
2

If the only reason the script needs to be run as root is to read/write to your specific directory, there are two ways for you to solve this (to allow a regular user to run the script successfully):

  1. Created a group, make the folder you are working in owned by that group, and add the user to that group.
sudo groupadd <groupname>
sudo usermod -a -G <groupname> <username>
sudo chgrp -R <groupname> <folder>
  1. Simply change the world permission of the folder (not recommended if you don't want any user on your computer to be able to access your cuckoo folder).
sudo chmod -R 664 ./cuckoo

This permission allows read and write for owner, group and world

  • Those options don't run the script as root. – Julie Pelletier Jun 21 '16 at 5:55
  • What do you mean? The script won't need to be run as root, because these commands allow the script to write to the working folder as a normal user. – joeeey Jun 21 '16 at 5:57
  • I really don't know about whether it does or doesn't need to run as u, so I'll abstain from voting for now, but it may be good to tag @JuliePelletier to let him know you answered his comment, and see what he has to say. – Marc.2377 Jun 21 '16 at 6:11
  • Standard Linux stuff - you created a group with access to the folder, added your regular user to that group, now the user has permissions to that folder. Alternatively you can chown the folder to that particular user, if you only want one user to have access to the folder. – MishaP Mar 21 '18 at 15:17
0

It appears I may have misinterpreted the question. If the script needs to be run as root regardless, and you want a regular user to be able to execute it, you can use follow the instructions found over on this AskUbuntu question.

Keep in mind that you will need to have the permissions locked down tight in this file for this to be secure.

Make the file owned by root and group root:

sudo chown root.root <my script>

Now set the sticky but, make it executable for all and writable only by root:

sudo chmod 4755 <my script>

Keep in mind if this script will allow any input or editing of files, this will also be done as root.

The SetUID bit makes a script or binary always run as the owner of the file/binary, an example of such a binary is 'passwd'.

  • Thanks for the reply. I think my issue is more like give a normal user restrict root access to execute python and read & write a directory. But otherwise I don't want that normal user to have any other root access, and these files should also be accessible to other superusers. – Xiechen Jun 21 '16 at 20:03
  • Just to clarify, I don't want to include this user as root, so now I've added this normal user to a group as you've suggested above. And the group right now has the permission to read and execute, but can't write, which would cause trouble to run "cuckoo.py" successfully. Any way to fix this permission? – Xiechen Jun 21 '16 at 20:30
  • 1
    @Xiechen As I said in my answer above, you need to chmod with permissions 664 for owner and group read+write. – joeeey Jun 21 '16 at 20:40
  • @joejoe31b: Apparently I was the one who misunderstood. Note that this answer is flawed though. The sticky bit only works with binary executables so you should remove this answer altogether. – Julie Pelletier Jun 22 '16 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.