锁定没有根特权的特定文件夹

Question

I need to chown a file to some other user, and make sure it is unreadable again. Sounds complicated but it will be mainly look like this:

cd /readonly
wget ...myfile
cd /workdir
chmod -R 444 /readonly
chown -R anotheruser /readonly

ls /readonly # OK
echo 123 > /readonly/newfile # Should not be allowed
cat /readonly/myfile # OK
chown 777 /readonly # Should not be allowed

In SunOS I saw something similar to this, I remember not being able to delete the disowned files by Apache, but I could not find something similar to this in Linux, as chmod requires root privilleges.

The reason I need this, I will fetch some files from web, make sure they will be unchangable by the rest of the script, only root can change it. The script can not definetely run as root.

Answer 1

On many *nixes (Linux, at the very least), this will be impossible. chown is a privilege restricted to root, since otherwise you could pawn off your files on other users to avoid quota restrictions. In a related case, it would also pose something of a semantic problem if arbitrary users could chown files to themselves to gain access.

More precisely, you can chown files that you own to change their group ownership information, but you can only change user ownership if you are root.

In any case, chown is the wrong hammer for this particular nail. chmod , which you are already using, is the correct way to make a file read-only within a script. The chmod 444 that you are already doing will protect against accidental modifications to the files. You cannot "freeze" or otherwise render permissions static as a Unix/Linux user without elevating to root privileges (at which point, you can chown them to root:root and no one other than root can change permissions or ownership on them).

In terms of script design, you should not need to be more restrictive than this. If your script is haphazardly chmod ing or rm -f ing files, then you have much more serious correctness problems to worry about than ensuring that the downloaded data is safe and sound.