chown

[j773303]

Is it possible let user can't change file owner and group?
For ex:
ll test1, the output as below
--------- file1 test1 users

Then, how to let user test1 can't change owner and group, I try chown bin:bin file1, it's ok to change it, but I don't want to change the user file owner and group, only the root can change it.

[T G Manikandan]

Any owner of a file can do a chown on that file change ownership to another user.

If you want to disable the chown for a user.Make sure that is home directory and files are not owned by him.

[Steven E. Protter]

easy way.

let root own the file.

Or follow the advice in the prior post.

SEP

[j773303]

setprivgrp -n CHOWN

Any impact or security issue on this? Thanks.

[T G Manikandan]

That command will take the CHOWN for all groups/users.

[Michael Schulte zur Sur]

Hi,

I think, the user must have rights to write for the direcory and the file. The access for file1 is nothing. Changing the owner ship for a non root user to another user wont work.

greetings,

Michael

[Bill Hassell]

The owner of a file can change the ownership of their own files. Simply change the ownership to another user such as test2 (or root). Then test1 cannot change the ownership (error = not owner). The file contents can be read or written as controlled by the permissions of the file, BUT the file's existence (ie, mv or rm) is NOT controlled by the file's permissions/ownerships, it is controlled by the directory's permissions/ownerships.

[hein coulier]

I was thinking that acl's could provide the solution, but 'man 5 acl' is repeting previous posts :

The right to alter DAC information (permission bits or ACL entries). Change permission is granted to object (file) owners and to privileged users.

so even a "chacl (${ownername}.%, ---) *" should not work. However, i remember i examinded the veritas acl-version (that comes with jfs4 if memory servers me well), and that is had a different behaviour than the standard acl. Unfortunatly, i don't have any system with the veritas acl-soft on, so i can't help you any further.