Re: Negative permissions WITHOUT ACLs

In article <1160572724.150078.47390@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
"Starfish" <frel8817@xxxxxxxxxxxxx> wrote:

Hello, if someone can answer this question you make a lot of Uppsala
University students happy.

Here goes: How do you specify negative permission¹ in Unix/Linux
without using ACLs?

¹E.g. saying that the user "Ellen" should not have write access to a
file regardless of the permissions given to her groups.

Make ellen the owner of the file, and omit the write permission from the
owner, i.e.

chown ellen filename
chmod o-w filename

However, a problem with this is that since ellen is the owner, she can
change the permissions and give herself write permissions. So this is
really only useful as a safety net, or in restricted environments where
users don't have access to the chmod command (e.g. it can be useful on
FTP servers -- you can create an anonymous upload directory where the
anonymous userid doesn't have any permissions to the files they've
created).

--
Barry Margolin, barmar@xxxxxxxxxxxx
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
.

Relevant Pages

  • Re: Object permissions
    ... Who is the owner of the query? ... permissions does the owner have on the underlying tables? ... does the user have on the query; ... to 'owners' in the sql statement each time the code runs, ...
    (microsoft.public.access.security)
  • Re: Security without signon
    ... I cannot change the owner of the ... rather than inherited permissions by virtue of group membership. ... the default Admin user is the same across all mdw files. ... accounts plus the account for my SuperUser and the account for my SuperGroup, ...
    (microsoft.public.access.security)
  • Re: Permissions denied ifcfg-eth0
    ... network-functions because it wants to access ifcfg-eth0) ... Copy the EXACT error messages. ... is for the owner of the file. ... Further, processes running _as_root_ ignore permissions, because root is ...
    (alt.os.linux.redhat)
  • Re: NTFS folder permissions - Creator Owner issue (I think)
    ... From what you're telling me an owner has rights that cannot ... which seems to include the right to change permissions whether we ... >> the grant to Creator Owner becomes a real grant to the creator or the ...
    (microsoft.public.security)
  • Re: Control over creation of procs & views owned by dbo
    ... To add on to Jasper's response, you could also change object ownership to ... 'dbo' with sp_changeobjectowner. ... security context of the invoking user, not the object owner. ... need permissions on only directly referenced objects. ...
    (microsoft.public.sqlserver.security)