Apache chown on its files not working

Linux and Unix-Like Red Hat
1

Hello,

My apache user generate one file :

# ls -lsa /tmp/reference_file.csv
76 -rwxrwxrwx  1 apache apache 69921 Aug 16 14:14 tmp/reference_file.csv

the user and the group belong to apache, but when i am trying to change it :

su -l apache -s /bin/bash
-bash-3.00$ whoami
apache
-bash-3.00$ chown explorer:btunix /tmp/reference_file.csv
chown: changing ownership of `/tmp/reference_file.csv': Operation not permitted

I tried to another folder, but the result was the same, I ve also checked attribut :

 # lsattr /tmp/reference_file.csv
 ------------- /tmp/reference_file.csv

there is no immutable attribut

How can I do ?

Thanks

2

Do you have write permission on the directory?

Robin

3

What's user apache 's permissions on /tmp ?

4

I think apache get no restriction no ?

ls -lsa /
...
888 drwxrwxrwt   161 root    root   901120 Aug 16 15:12 tmp
...
5

The man-page helps. From man chown :

       Only the root user can change the owner of a file. You can change the
       group of a file only if you are a root user or if you own the file. If
       you own the file but are not a root user, you can change the group only
       to a group of which you are a member.

By becoming root.

I hope this helps.

bakunin

1 Like
6

Ok, I thought, I could have change the owner only if i am the owner.

7

Allowing normal users to "give away" files would create HUGE security holes, and, on systems that charge users for the disk space they use, would allow you to change your files to world readable and writeable and have another user billed for your disk use while still having access to your data (even after you have given them away).

8

You cannot give away user ownership of the file as a normal user. But you can change the group of that file if user ID 'apache' is part of 'btunix' group.
Otherwise add 'btunix' group as a secondary group of 'apache' user.

chgrp btunix /tmp/reference_file.csv

Ofcourse only 'root' user will be able to do the groupadd to 'apache' ID :cool: