Allow rwx (perm) for a single dir without implying parents?

kgdrenefort

Hello,

I face a new problem with how I manage my ownership, groups and permissions on a sub-directory list of files and directories.

This might be me being delusional, but so far I had a working permissions and ownership schemes for my web servers sub-directory list.

The scenario :

My server hold datas inside a mounted disk, this disk contains many directories and one, called " server ".

/mnt/server it is, the permissions are d rwx r-x r-x (755 then), for srvadm:nginx. While srvadm is the user I persona to works inside this /mnt/server/www directory I'm facing problem with.

/mnt/server/www is d rwx r-x --- (750 then), for srvadm:nginx. The idea here was to allow both user srvadm to act when needed and allowing nginx to act as well without allowing anyone else to even be able to read anything, for CMS I only enable nginx:nginx, for simple HTML/CSS site I use srvadm:nginx and for now it works like a charm.

The problem :

A local (LAN) user needs to connect from SSH to this server, connected as (let's say) dumbuser. This dumbuser needs to open one only and single directory (execution, then) and be able to read, write and execute as much as needed only in this directory, and only be able to access it without being able to reach anything else.

So, if the needed path for dumbuser is /mnt/server/www/somedir1/anothersubdir1, this should be executable for this user and only be able to read, write and execute inside. So this user should not be able to access (open) any other dir (brother or parents) that is not a child of his target : /mnt/server/www/somedir2 should be forbidden, as another other brothers, as of course /mnt/server/www/somedir1/anothersubdir2 is also forbidden.

To achieve that, I tried to add dumbuser to nginx group, to test a bit, it can't go inside /mnt/server/www but can access /mnt/server, since this path is for other r-x, which is not the case for /mnt/server/www. I'm a bit out of idea to do that without breaking my home-made law of forbidding everything to this dir to " other " ?

Am I trying to do something impossible ?

How could I open a " magic teleporter " for dumbuser to access (rwx for files as dir) /mnt/server/www/somedir1/anothersubdir1 and not anything else ?

I hope this is clear, if it's not don't hesitate to ask me to reformulate.

PS: To the question « Why simply don't use srvadm ? » I'll simply answer that this user is not made for this, it's a private user and this dumbuser should only be able to execute only this specific dir and rwx in it. For, many reasons, security (at least not allowing this person to do a mistake, it's safer this way I think).

Regards,
GASPARD DE RENEFORT Kévin
_________________
Traduction wiki, pour praticiper.
Custom logos/biz card/website.

pingtoo · Posted: Tue Jul 30, 2024 11:25 am Post subject:

I suggest for the given "dumbuser" with restricted login shell with home set to /mnt/server/www/somedir1/anothersubdir1

restricted shell usually design to only allow work in the given directory and its descendant and only execute program that is in defined PATH variable.

Please note, restricted shell is not a security feature, it is mean to support casual user to prevent unwanted mistake.

Hu · Administrator Joined: 06 Mar 2007 Posts: 22618

To operate on a directory, a user needs search on every traversed directory, or the capability to bypass the permissions check. If you want dumbuser not to be a member of group nginx, then an ACL could grant to dumbuser the search permission on the required directories. You say dumbuser is a member of nginx, so what you describe seems to me like it should have worked. Per Guidelines item #4, please show us the actual state:

As root, the output of namei -l /mnt/server/www/somedir1/anothersubdir1 /mnt/server/www/somedir1/anothersubdir2
As dumbuser, that same command, and the output of id.
As dumbuser, the output of > /mnt/server/www/somedir1/anothersubdir1/tempfile ; > /mnt/server/www/somedir1/anothersubdir2/tempfile, so that we can see whether the user can really write to those directories.

szatox · Advocate Joined: 27 Aug 2013 Posts: 3418

no101 · n00b Joined: 10 Oct 2022 Posts: 13 Location: Piney Woods

Not a direct solution but you could work around the problem and use a bind mount to (also) mount the directory in dumbuser's home directory. Something like...

kgdrenefort · Posted: Thu Aug 01, 2024 7:32 am Post subject:

kgdrenefort · Posted: Thu Aug 01, 2024 7:35 am Post subject:

kgdrenefort · Posted: Fri Aug 02, 2024 1:24 pm Post subject:

Hello,

I tried to mount a directory within dumbuser /home (aka justine here).

Then once it was mounted, I tried to write, which is sadly not working (and I was expecting this). I used :

Hu · Administrator Joined: 06 Mar 2007 Posts: 22618