2

I have some directories with quite permissive permissions, which get cluttered up with files (scripts) created by lots of different users. I try to encourage people to create their own sub-directory and add their files in there, but some do not, leaving the root scripts directory full of things others are not interested in.

Since I have only had limited success in persuading people from creating files in the root directory, but we still need all users to be able to access any of the scripts, I was hoping that we might be able to enforce the policy of scripts being written into a subdirectory using permissions or access control lists.

So, is it possible to allow users to only create directories in the root scripts folder, but allow them to create scripts only in those sub-directories?

Improve this question

1 Answer 1

Reset to default
2

It's not a great solution, but:

  • make the directory writable only by you, or some designated user or pseudo-user, or, perhaps better yet, a group (that your users are not members of),
  • carefully write a wrapper for mkdir, and install it setuid or setgid.


  • If you choose the group / setgid option, it could be as simple as 
    mkdir("root_scripts/<user's folder name>", 0755);

    And, if you don't care about making the folder owned by the user who created it, that's all you need to do if the program is setuid.  Otherwise,
  • If you make the program setuid root, be very very carefully to do a million checks for inappropriate usage, and then 
    mkdir("root_scripts/<user's folder name>", 0755); chown("root_scripts/<user's folder name>", <user's uid>, <user's gid>);
  • If you make the program setuid to a non-root user, create a world-writable subdirectory in (or somewhere under) your root_scripts directory, and do something like 
    euid = geteuid(); ruid = getruid(); seteuid(ruid); // Person who's running the program mkdir("root_scripts/.writable_subdir/<user's folder name>", 0755); seteuid(euid); // Owner of the program and the top-level directory rename("root_scripts/.writable_subdir/<user's folder name>, "root_scripts/<user's folder name>");
Improve this answer
4
  • If the wrapper is setgid (and that's what it should be), the directory will be owned by the calling user. Commented Apr 14, 2015 at 23:10
  • @Gilles: Yes, I know.  I see now that what I wrote wasn’t crystal clear.  Let me rephrase it: “If you choose setgid, it could be as simple as mkdir(…);. (period)  If the program is setuid, then that (mkdir(…);) is sufficient, unless you care about the ownership of the folder; in that case, you need to take extra steps to establish correct ownership.  …” Commented Apr 15, 2015 at 2:54
  • Thanks Scott, setuid scripts are not an option here unfortunately, but at least this helps me confirm that what I want to do isn't possible. Commented Apr 20, 2015 at 12:57
  • First of all, I said it could be setuid or setgid, and, as @Gilles points out, setgid is better.  Secondly, are setgid programs off the table, or only setgid scripts?  Because I wasn't suggesting a script; I was suggesting a program, in a language such as C, that can be compiled to a binary executable. Commented Apr 20, 2015 at 17:50

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.