允许非root应用程序修改/ etc中的只读文件

Question

I am trying to have an almost idiotproof configurator for network and some other stuff for embedded device running on linux. Application is saving to /etc/network/interfaces without problem when run by root, but returns "segmentation fault" when run by standard user. strace returned:

open("/etc/network/interfaces", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied) --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0} ---

How can I allow it to be launched by anyone and write to /etc/network/interfaces ?

Code for saving to file:

            FILE *saveFile;
            saveFile = fopen("/etc/network/interfaces","w");
            // loopback
            fprintf(saveFile, "auto lo \niface lo inet loopback\n\n");
            // eth0
            fprintf(saveFile, "auto eth0\niface eth0 inet static\n\taddress %s\n\tnetmask %s\n\tgateway %s\n",
                    address,netmask,gateway);
            fclose(saveFile);

Answer 1

How can I allow it to be launched by anyone and write to /etc/network/interfaces ?

Mmmmm... By giving write permissions to anyone on /etc/network/interfaces ?

Answer 2

After your comment, your requirement is to allow a non root user to do a particular administrative tasks that would require root priviledge. The traditional way would be to make the program owned by root and setuid. This is now a throwned upon way, because a setuid program (su or sudo are) should be thoroughly scrutinized for any potential security problem: a buffer overflow or other would allow execution of arbitrary code as root .

For your example, if it is a simple program, it could make sense, but at least the return value of every operation ( fopen and fwrite here) should be tested!

The recommended way for that will now be to use sudo and set specific entries in the /etc/sudoers file to allow any user (or a specific list of groups and/or users) to execute that specific command as root. To achieve almost the same that a setuid command but prompt the user for his/her password to notice him/her of an administrative task:

ALL local_host_name = (root) /full/path/to/command

But the sudoers syntax allow much finer grained authorizations.

(Beware: you still have to twice control your code)

Answer 3

you can try something like this :

• install sudo
• create a new user
• Give sudo permission for the new user only on your program.

This way, when people will try to execute any command other than your program,it will be refused.

Now, your program will run with sudo rigth, so make sure that your program cannot be modified or replaced by another program (like chmod 700 and chown root) and make sure your program will not mess /etc/network/interface