Restrict User to only execute the file.

Linux and Unix-Like Linux
1

Hi Gurus ,

I hope you are doing great .
Other than owner of the file , OTHERS and GROUP should be restricted from read or write a file created by the owner.
OTHERS and GROUP should be only allowed to execute the file.

Thanks in advance.

2

Read...

man chmod
3

Hi Malcom,
thx for the advice.
I am aware of chmod command but as you know for a user to execute a file he has to have a read permission , which in my case should not be allowed .
Pls advice.

4

A user needs only execute permission to execute a file and does not need read permission, unless it is a script.

5

Yes it is a script which contains authenticating details .

6

I have not tested this, but what you could do I suppose, is create a functional user that can not logon but that has the right to read and execute the script while other users can not. You can then use sudo and a sudoers definition so that a certain group of users or if you like eveyone can execute the script as that functional user without a password.

7

Thanks for your interest.

Actual scenario :

we have sqlconnect string stored in a file. The same file will be used by multiple user to connect to a Database by execting the file. Our motive is to make sure that other than owner no one should be allowed to view or write the file content.

I have tried the same but i am unsucesseful as one cant execute a file unless and until he has a read permission on the file.

8

What I mean is you can create a user that can not login. You could call it sqluser for instance. Make sure the user can not login directly. Make thus user the owner of this file (let's call it "connect_db") and make the file -r-x------ (0500).

If you create a definition in the sudoers file such that certain users become the user sqluser without issuing a password and as such are only allowed to execute the script "connect_db", I think that should work .

The users would have to issue the following command to access the database through the script:

sudo -u sqluser /path/to/script/connect_db

They would not be able to read the contents of connect_db.

See "man sudo" and "man sudoers" for further details.

9

Have you tried using ACLs?
Have you tried using a wrapper to execute the file, which can be SUID to another user?