Copy files and keep permissions 1

[angelshark]

Hello,

I would like to allow a regular user to copy files from other users and keep the original permissions without giving him the root access.

I have tried to copy a folder that belonged to a service account with the '-pr' switches but the resulting folder will have my ownership instead of the original permissions.

Is there a way to accomplish this without recurring to the root account?

Thank you very much.

 

[KenCunningham]

I haven't tried it and it may not suit your need, but have you tried tarring the files and then untarring them to wherever you're putting them?

 

[angelshark]

I just tried it but unfortunately it doesn't work. When you untar the file it changes the ownership to my user.

Thanks anyway.

 

[daFranze]

no, a user just can COPY someoneelses' files, after that the files are your's; this is a security feature. eg. a file is a setuid script. With copying the script you could act as the other user. Only root (or sudo user) can copy other user's data and keep user, group and access dates...

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[angelshark]

What if I authorize a regular user to run the "cp" and "mv" commands as root (via sudo), would I be able to accomplish my goal?

Thank you very much for your help.

 

[daFranze]

yes (I'm 90% sure)

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[SamBones]

Yikes! Be VERY CAREFUL how you set up sudo to allow a user use to "cp" or "mv" as root! You're basically letting them OWN or trash your machine if you don't limit what they can do. Letting them cp or mv as root will let them do just about anything.

I would find another solution.

Hope this helps.

 

[angelshark]

Wow, i've installed sudo in our server and it works perfectly! Now our data manager can migrate the data into our NetApp Filer and keep the original file permissions without using the root account. Thank you very much daFranze for your tip. I know it's dangerous to allow him to use mv as root but it's way better than giving him the full root account.

 

[daFranze]

Welcome! Thanks for the star!

Yes it is dangerous to give someone sudo privileges such as mv but I think, just as angelshark writes, it's better than full root access. Usually a data manager is part of the IT infrastructure, he is an IT Admin and Admins should know that they can destroy things if they do not act carefully.

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years