User Permissions

Question

Is there any way with which, using shell scripts, I can execute a program as another user, in a uniquely(randomly) named directory, where the user has rwx access to all the files in that directory, but cannot change anything outside it.

i.e. When a program is executed using this script in a folder, it can only access files inside the folder and cannot change any system settings or navigate outside this folder

score 2 · Accepted Answer · edited Jun 12 '20 at 14:37

You could use rbash (or bash -r): it is a restricted version of bash that imposes some limitations to the user with respect to full bash. From rbash man page:

It behaves identically to bash with the exception that the following are disallowed or not performed:

   o      changing directories with cd
   o      setting or unsetting the values of SHELL, PATH, ENV, or BASH_ENV
   o      specifying command names containing /
   o      specifying a file name containing a / as an argument to the . builtin command
   o      Specifying a filename containing a slash as an argument to the -p option to the hash builtin command
   o      importing function definitions from the shell environment at startup
   o      parsing the value of SHELLOPTS from the shell environment at startup
   o      redirecting output using the >, >|, <>, >&, &>, and >> redirection operators
   o      using the exec builtin command to replace the shell with another command
   o      adding or deleting builtin commands with the -f and -d options to the enable builtin command
   o      Using the enable builtin command to enable disabled shell builtins
   o      specifying the -p option to the command builtin command
   o      turning off restricted mode with set +r or set +o restricted.

To use rbash trasparently, start your script with #!/bin/rbash.

Hope this help.

omnidan · Answer 2 · 2011-04-10T11:10:36.970

0

Use:

sudo -u USERNAME

EDIT: To use this command without entering password, use:

echo PASSWORD | sudo -u USERNAME COMMAND

Replace PASSWORD with the password of USERNAME. Replace USERNAME with the username. Replace COMMAND with the command you want to execute.

For example:

echo password123 | sudo -u daniel cp ./file ./dir/filecopied

I hope this helped you, Daniel

edited Apr 10 '11 at 11:10

answered Apr 10 '11 at 10:57

omnidan

2,035
1
19
22

1

You'd better run `sudo visudo` to edit the `/etc/sudoers` file and add a NOPASSWD for the command instead of writing the password in the script. – Lekensteyn Apr 10 '11 at 11:41
@Lekensteyn Make it a separate answer. – Adam Byrtek Apr 10 '11 at 22:09
@Adam Byrtek: the question needs additional details. In the current form, the answer would be "no, it is not possible". For usage instructions on NOPASSWD and visudo, see [this question with instructions on running mount as root without a password](http://askubuntu.com/q/19611/6969). Note that the script will be run as root. – Lekensteyn Apr 11 '11 at 12:58
On a side note. By default, sudo does not read the password from stdin, it reads it directly from the terminal, so `echo PASSWORD | sudo -u USERNAME COMMAND` will not work. Just run the script as root. With the default sudoers, root can run commands as any user without requiring a password. – geirha Apr 17 '11 at 09:10

User Permissions

2 Answers2