[ale] Allow non-root user to chown file to other user?

[Thomas Stromberg]

Thanks for mentioning this. sudoers allows you to specify exactly what
chown's would be allowed in this case. I've used this in the past
where I wanted to allow chown to work on a single file with a single
destination user.

On 11/15/07, Brian Pitts <brian at polibyte.com> wrote:
> Thomas Stromberg wrote:
> > If you really wanted to implement this, you could do so with the
> > following script. While I know you are not a fan of the sudo approach,
> > combined with this script, it would be invisible to your users, and
> > add a syslog entry each time this extended-functionality is used. This
> > way you can audit any ownership changes you might have.
> >
> > -- 8< ---------------------
> > #!/bin/sh
> > # This assumes you have configured the "admin" group in sudoers for
> > # password-less chown.
> > #
> > # It's recommended you place this somewhere in path such as /usr/local/bin
> > # rathern than overwriting /usr/sbin/chown, but both will work.
> >
> > CHOWN_GROUP="admin"
> > REAL_CHOWN="/usr/sbin/chown"
> > chown_cmd=$REAL_CHOWN
> >
> > for group in `groups`
> > do
> >   if [ $group = $CHOWN_GROUP ]; then
> >     chown_cmd="sudo $REAL_CHOWN"
> >   fi
> > done
> >
> > $chown_cmd $*
> > -- 8< ---------------------
> >
>
> Until they chown syslog and remove those entries. There's a thread about
> this issue here.
>
> http://lists.debian.org/debian-security/2001/07/msg00160.html
>
> THe best advice I see is "VERY CAREFULLY construct a wrapper that
> validates input (i.e. requires absolute paths under a given directory
> (i.e. /home) w/o symlinks, matches argument against a list of valid
> files, etc.) and then executes the chown itself, and give the user sudo
> permission to run the wrapper."
>
> -Brian
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>