emergency help: should I use setuid in this situation or something else

[Hanry Zhou]

I have a number of files "xyz.1", xyz.2",... under the directory "dirname"

cd dirname(with permission of 775)
ls -l
-rw-rw---- david users xyz.1
-rw-rw---- david users xyz.2
...

now, I have another id called "john", and he belongs to group "grp-a", and "john" want to be able to read all these xyz.* files. What I should do to achive this?

I did chmod 2775 on dirname, but "john" still can't read all these xyz.* file.

Can 2775 to achive what I want, and what is the correct method to achive what I want.

Thanks,

[Patrick Wallek]

SETUID and SETGID have absolutely nothing to do with being able to read a file. They only effect an executable (shell script or program) file.

If user john needs to read the xyz.* files, add him to the users group. Just keep in mind that at that point he has access to anything with a group of users and the appropriate permissions.

[Rodney Hills]

Do a "ln /etc/group /etc/logingroup", then find the entry for "users" in /etc/group and append "john" at the end.

This will allow john to have access to files/directories that are part of the "users" group, and john remains part of the grp-a group.

HTH

-- Rod Hills

[Jeff Schussele]

Hi Hanry,

Use chmod in that dir as follows:

chmod 664 *

this will set -rw-rw-r-- & give read rights to others.

HTH,
Jeff

[Sridhar Bhaskarla]

Hi,

SUDO can help you here as you can configure it such that "John" can see the files under "dirname" as "david". But be cautious while configuring sudoers as you may inadvertantly open-up security holes.

-Sri

[Hanry Zhou]

Sri,

Can you please explore it a little bit more for me?

all these xyz.* file has permission of 660, and grouped by users, but "john" is not part of that group. I did chmod 2775 on "dirname" which contains all these xyz.* files, but john still can not read these files.

BAsed other postings, I can't achieve what I want by setting setgid.

[Patrick Wallek]

You are right.

As I said in my first reply the SETGID bit has ABSOLUTELY NOTHING to do with being able to read a file. SETUID and SETGID are ONLY applicable to executable files. Setting the SETGID bit will NOT help you in this case.

You must either add john to the users group, or change the permissions of the xyz.* files to be world readable.

# chmod o+r xyz.*

or

# chmod 664 xyz.*

[KapilRaj]

Check the directory permissions ... Does others have a "x" permission if not it will not allow anybody to get in there

Once done change the file permissions to 664 so that "Mr. john "can read it


Kaps

[Bharat Katkar]

HANRY,
Simple and URGENT way to do it is to add the JOHN to USERS group.
Take care of John getting exposed to USERS group.
That's it.

Regards,

[Rodney Hills]

Do a "man logingroup" for an explanation on how to give group access to users who are members of another group...

-- Rod Hills

[Marvin Strong]

If the user needs to access files from anyone in that other group add him to that group also, in /etc/group, and link /etc/logingroup to /etc/group if its not already done.

If he only needs access to that one directory of files, and not all files that belong to group "grp-a" then, just change the permissions on the files so they are world readable. (as stated above)