22

I would like to allow users to chmod a file that is owned by root or some user that is not themselves. I have chmod'ed the file to 777 and I get "operation not permitted". I have added the user to the group of the file and get the same. Why can't a user chmod a file they have write access to?

ashleysmithgpu
  • 4,337
  • 1
    By this logic, why not just run everything as root? If any user can change any mode, you basically destroy the entire Unix permissions model... – Chris Down May 15 '13 at 09:03
  • 1
    What do you want to do? maybe you should have a look into sudo:http://linux.die.net/man/8/sudo & http://linux.die.net/man/5/sudoers – xx4h May 15 '13 at 09:09
  • The file has permissions 777, a user could go "mv file file.old; cat file.old > file" and they would now own the file and can chmod it. Why can they not "chmod 777 file"? – ashleysmithgpu May 15 '13 at 09:12
  • 5
    No, they can only do that if they have write permission to the directory. If the user had the right to change the permissions of a files he doesn't own, by settings the 04777 mode, and copying /usr/bin/env into it, he could run any command as that user. – Stéphane Chazelas May 15 '13 at 10:42
  • 1
    @StephaneChazelas That is a strange argument because the kernel could easily decide (and does!) to allow non-owners such changes without being bound by that decision to allow them allkinds of changes. After all SUID is even reset when a non-owner writes the file. – Hauke Laging May 15 '13 at 12:16

2 Answers2

11

Unix permissions are designed to be simple. You need the read permission to read from a file, the write permission to write to a file, and the execute permission to execute a file. You need to own a file to modify its metadata¹.

Allowing a user who can read a file to grant others the read permission, or allowing a user who can write a file to grant others the write permission, would not change the security model much. That's because unix permissions are discretionary: a user who can read a file can expose its contents to other users, even if these other users would not otherwise be able to read the file (and similarly for writing, the user could act as a proxy and write on behalf of others).

On the other hand, allowing a user to grant permission that it doesn't have would completely break the permission system: the user could grant all permissions to itself.

It's pretty rare to need to change the permissions of a file that you don't own. Usually you should arrange for the file to have the right permissions as soon as it is created. If you really need that, you might give the user sudo chmod rights for a particular mode and a particular file (e.g. joe: ALL = (ALL) chmod g+r /path/to/file).

¹ Except for the access and modification times, which are particular because reading or writing to the file also sets them.

Gilles 'SO- stop being evil'
  • 829,060
  • In my use case there is both a web process (by www-data) and a cli process (by myself), that want to set permissions on a file. I added myself to the www-data group, but this is not sufficient. – donquixote Mar 04 '17 at 23:40
  • Even changing owner/group to myself:www-data does not help. (I have not designed the mechanism that tries to set the permissions, I have no control over it) – donquixote Mar 04 '17 at 23:42
9

Why can't a user chmod a file they have write access to?

For the normal access rights this is a design decision. You need richacls: WRITE_ACL and maybe WRITE_OWNER.

Hauke Laging
  • 90,279
  • 1
    And you should warn that richacls is not generally available. – sendmoreinfo May 15 '13 at 12:35
  • @sendmoreinfo The Wikipedia article says that and it obviously has to be read as my answer does not explain what richacls are and how they are used. It's ridiculous to consider a correct answer "not useful" due to this. Especially as there is no equivalent alternative. Next time make an edit if you think such information is necessary. – Hauke Laging May 15 '13 at 12:44
  • I see, it is a design decision, thank-you – ashleysmithgpu May 15 '13 at 12:54
  • 2
    You obviously used the feature, so explain it yourself, in your own words. – sendmoreinfo May 15 '13 at 18:23
  • @HaukeLaging - please take a look at my related question that has a bounty here: https://unix.stackexchange.com/questions/627572/how-to-apply-and-use-rich-access-control-lists-with-btrfs – MountainX Jan 12 '21 at 20:03