Removing permissions from all users including owner

Hello all:

I will include a "requirement" for an issue I am attempting to solve for my boss. Basically, he would like to know if there is a way to prevent users and owner from editing 'write' script in Vi.

• While working in Unix Vi, users would be able to keep all the previous versions of the script being edited. If an attempt is made to edit a script from command line (using Vi), an error message should be shown, coaxing the user to edit the script from a Windows Sub-version environment. The user, however, should be able to read and execute script.

I am not a Unix user at all, so I do not know much terminology dealing with the subject. If anyone knows of any plug-ins or any ways to make this permission restriction possible, I'd greatly appreciate your comment! Thanks.

On what operating system is "vi" being executed?

Unix :o

---------- Post updated at 12:56 PM ---------- Previous update was at 12:53 PM ----------

sorry, windows xp professional 2002 is what my computer runs. The developers' may be different, but I doubt it

Unix is not so much an operating system. It is a standard upon which organizations and companies base their own systems.

Post the output of below command:

uname

"Unix" is a very broad term. Can you run uname -a from the prompt that is used to launch "vi"?

Unix-AIX

It would really help if you posted the actual output of uname -a ...

I really wish I could, but I don't have any access to Vi. The best I could do was tell you that it is AIX

---------- Post updated at 02:01 PM ---------- Previous update was at 01:42 PM ----------

So is there a way you can help me even if I don't have the output from the uname -a command?

We are not withholding things from you out of spite... The system may be important, particularly for how it supports ACLs and the like.

How are you even going to accomplish this solution without a terminal?

I am only trying to find information pertaining to if what I am asking can be done in Vi. I don't have access to Vi. I am trying to gather as much information as possible, with what I have. I apologize for not being as much help as I'd like to be, but I really don't have anything you guys are asking.

If you have heard of this being done before in Vi, please let me know----

o " Require that the Unix editor �vi� to have version control available. While working in Vi, users would be able to keep all the previous versions of the script from being edited. If an attempt is made to edit a script from command line (using Vi), an error message should be shown, coaxing the user to edit the script from a Windows Sub-version environment. The user, however, should be able read and execute script."

---------- Post updated at 02:17 PM ---------- Previous update was at 02:08 PM ----------

This is literally all I need to know. It shouldn't matter what OS is being ran, I just want to know if anybody has ever seen or heard of Vi having version control available; to where users would be able to keep all versions of the script from being edited. If an attempt is made, a message should be shown telling the user to edit the script in subversion. The user should only be able to read and execute script.

Can this be done?

If you set a script read-only then they will get 'permission denied' when they try to write to it, but it won't say 'edit in subversion'. I think you'd have to customize vi to do that.

Is that also for the 'owner' as well? My boss wants absolutely no editing to be permitted in Vi. Only read and execute.

Root users will override this, otherwise it should restrict it for the owner as well. Still, knowing the system would help make it more specific.

A bigger problem would be preventing them from just doing 'chmod +w scriptname' out of frustration, or deleting it, or other such tomfoolery.

Realistically speaking, if you don't want them to edit these things -- why are they the owner?

To be honest, I have no idea actually. Different developers get different access. Maybe my boss is just looking for a quick fix rather than going in and removing people as owners. I honestly don't know.

I really do appreciate your help Corona, I'm sorry I couldn't provide you with as much information as I would have liked to. Hopefully when I conduct further research I can tell him some sort of solution, whether it be just removing write permissions from everyone.

if you have the "-R" option in your vi implementation (see "man vi"), you could probably create a wrapper script for vi to start in read-only mode unless the user is in the "allowed" group ... you can either (1) create the wrapper script to start first in the users' PATH or (2) you can move /usr/bin/vi to /usr/bin/viorig and name the wrapper script /usr/bin/vi that would call /usr/bin/viorig with the correct options ... if using option 2, make sure that you have a copy of the wrapper script somewhere else that you can copy back in place after system upgrades as you may have to rename /usr/bin/viorig back to /usr/bin/vi prior to the upgrades ... sample below assumes an "allowed" group in /etc/group and sends email when vi in edit mode ...

#! /bin/ksh
admin=admin@some.com
allowed=$((grep $LOGNAME /etc/group | grep allowed > /dev/null) && echo "yes" || echo "no")

if [ $allowed = "yes" ]
then
      echo "$LOGNAME has activated vi in edit mode" | mailx -s "vi in edit mode" $admin
      /usr/bin/viorig $file
else
      /usr/bin/viorig -R $file
fi

exit 0

I think it is time for a few clarifications:

"vi" (btw: it is written lowercase, as UNIX is case-sensitive and "Vi" or "VI" would be entirely different things) is an editor - a means to write and edit texts. Think of it like "notepad.exe" (with the difference that it is very powerful, unlike notepad). In fact it does only this: editing files. If you want have some different function (like version control) you will have to accomplish that with some other tool.

This brings it to the second point: UNIX is a collection of very small, very specialized tools. It is understandable that you want the tool you use ("vi") to do something to accomplish your goal, but usually this is just wrong (i.e. "not UNIX-like") thinking. You will have to use another tool, specialized in doing what you want to accomplish, and combine that with the first.

So far some general remarks about UNIX behavior (you said you wanted to explain that to your boss, therefore some "philosophy" behind it).

Rights in UNIX are quite simple (note experts: i simplify here a bit, for the benefit of easier understanding): there is a "read", a "write" and an "execute"-right. This triplett of rights is given for: the owner of a file, the group, the owner belongs to and for everybody else. This means 3x3=9 different rights ("privileges"), which can either be there or not.

The easiest way to accomplish what you want is: first, create a group where all the developers are a member of. (Every user can be member of any number of groups, so introducing one more is no problem). For the files in question, make them owned by exactly this group. Then set the "read"- and "execute"-rights for the group and deny the group write-rights. Now every member can read and execute the file(s) but not overwrite it with another version.

In AIX (this is IBMs UNIX) this is done by (in the following i use "developers" as group name and "devacctN" for the developers accounts, feel free to change this):

# create the group developers
mkgroup developers

# now, add all developers to this new group
chuser groups=developers devacct1
chuser groups=developers devacct2
chuser groups=developers devacct3
...

# finally, change the files permissions and ownership
chown :developers /path/to/file

# change the permission for this file
# grant read and execute
chmod g+rx /path/to/file
# deny write
chmod g-w /path/to/file

I hope this helps.

bakunin