Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #209159

Re: How to set access permissions to protect a database file?

Show all headers | View raw

On 5/25/19 8:12 PM, mick crane wrote:
> On 2019-05-26 00:49, Markos wrote:
>> Hi,
>>
>> I made a program (reading_room.tcl), with Sqlite running on Debian 9,
>> to control the books of a reading room.
>>
>> I implemented an authentication system for common users and
>> administrator users in the reading_room program.
>>
>> Now I want that any user logged in the Linux be able to run the
>> program reading_room.tcl, which will access the database (books.db)
>>
>> But I want to protect the file books.db so that only the the program
>> reading_room.tcl can access the books.db file. But that no user could
>> delete or write to the file books.db (only the program
>> reading_room.tcl)
>>
>> Please, how can I configure the system to do that?
>>
>> How to define the permissions?
> 
> I'll have a go, sure I'll get pulled up if off.
> 
> read 4, write 2, execute 1  add these together for permissions
> owner, group, anybody
> 
> I never did anything on a PC with other people having access so I never 
> made a file only executable by anybody but I don't see why not.
> As you wrote reading_room.tcl presume that belongs to you.
> I don't know anything about tcl as yet but assume it's executable as it 
> is and does something.
> You may have a group librarians that want to have read/write access to 
> reading_room.tcl
> Assume you have backups of the files.
> guess books.db wants to be 644
> "su -"
> "chmod 644 books.db"
>   or if the librarians want write access to it.
> "chown you.librarians books.db"
> "chmod 664 books.db"
> 
> "chown you.librarians reading_room.tcl"
> "chmod 771 reading_room.tcl"
> 
> mick


I don't believe there is a solution using just read, write, and mode 
bits and group membership.  (Perhaps, there is a solution if you also 
use access control lists?)


Suppose I have a Perl script "shared-program.pl" (sorry, I don't know 
TCL) that reads a line from the terminal, lower cases the line, and then 
writes the line to the terminal.  If the line contains the word "write', 
the line is also written to a data file "shared-program.dat":

2019-05-25 20:31:43 dpchrist@tinkywinky ~
$ ll sandbox/perl5/shared-program.pl
-rwxr-xr-x 1 dpchrist dpchrist 267 2019-05-25 20:31:35 
sandbox/perl5/shared-program.pl*

2019-05-25 20:31:49 dpchrist@tinkywinky ~
$ cat sandbox/perl5/shared-program.pl
#!/usr/bin/env perl
use strict;
use warnings;
use FindBin	qw( $Bin );
use File::Slurp;
use constant DATAFILE => "$Bin/shared-program.dat";
print "$0 >";
my $line = <>;
$line = lc $line;
write_file(DATAFILE, {append => 1}, $line)
     if $line =~ /write/;
print $line;


If I run the program as the owner, it works as expected:

2019-05-25 20:34:01 dpchrist@tinkywinky ~
$ sandbox/perl5/shared-program.pl
sandbox/perl5/shared-program.pl >Hi, Dave!
hi, dave!

2019-05-25 20:34:15 dpchrist@tinkywinky ~
$ sandbox/perl5/shared-program.pl
sandbox/perl5/shared-program.pl >write Bye, Dave!
write bye, dave!

2019-05-25 20:35:09 dpchrist@tinkywinky ~
$ ll sandbox/perl5/shared-program.dat
-rw-r--r-- 1 dpchrist dpchrist 17 2019-05-25 20:35:09 
sandbox/perl5/shared-program.dat

2019-05-25 20:35:22 dpchrist@tinkywinky ~
$ cat sandbox/perl5/shared-program.dat
write bye, dave!


The mode of 755 on the script allows other group members and all other 
users to run the script:

tinkywinky@tinkywinky:~$ /home/dpchrist/sandbox/perl5/shared-program.pl
/home/dpchrist/sandbox/perl5/shared-program.pl >Hello, Tinky Winky!
hello, tinky winky!


But, if I clear the world read bit on the script:

2019-05-25 20:35:24 dpchrist@tinkywinky ~
$ chmod o-r sandbox/perl5/shared-program.pl

2019-05-25 20:38:08 dpchrist@tinkywinky ~
$ ll sandbox/perl5/shared-program.pl
-rwxr-x--x 1 dpchrist dpchrist 267 2019-05-25 20:31:35 
sandbox/perl5/shared-program.pl*


Other users are not able to run the script because the Perl interpreter 
cannot read the script:

tinkywinky@tinkywinky:~$ /home/dpchrist/sandbox/perl5/shared-program.pl
Can't open perl script "/home/dpchrist/sandbox/perl5/shared-program.pl": 
Permission denied


(It might be possible for other users to run binary programs with just 
the world execute bit set?)


So, the world mode needs to be read+execute for other users to run 
scripts they do not own:

2019-05-25 20:59:32 dpchrist@tinkywinky ~
$ chmod o=rx sandbox/perl5/shared-program.pl

2019-05-25 21:05:53 dpchrist@tinkywinky ~
$ ll sandbox/perl5/shared-program.pl
-rwxr-xr-x 1 dpchrist dpchrist 267 2019-05-25 20:31:35 
sandbox/perl5/shared-program.pl*

tinkywinky@tinkywinky:~$ /home/dpchrist/sandbox/perl5/shared-program.pl
/home/dpchrist/sandbox/perl5/shared-program.pl >Blah Blah Blab
blah blah blab


Focusing on the data file, let's add the other user to the file's group:

2019-05-25 20:49:08 root@tinkywinky ~
# usermod -a -G dpchrist tinkywinky

2019-05-25 20:50:33 root@tinkywinky ~
# grep dpchrist /etc/group | grep tinkywinky
dpchrist:x:13250:tinkywinky


Log out and log in again as the other user to obtain the new group 
membership.


Enable the group write bit on the data file:

2019-05-25 21:09:45 dpchrist@tinkywinky ~
$ chmod g+w sandbox/perl5/shared-program.dat

2019-05-25 21:11:50 dpchrist@tinkywinky ~
$ ll sandbox/perl5/shared-program.dat
-rw-rw-r-- 1 dpchrist dpchrist 17 2019-05-25 20:35:09 
sandbox/perl5/shared-program.dat


Now the script can write to the data file when the script is run by 
other users in the same group:

tinkywinky@tinkywinky:~$ /home/dpchrist/sandbox/perl5/shared-program.pl
/home/dpchrist/sandbox/perl5/shared-program.pl >write Yada Yada
write yada yada

tinkywinky@tinkywinky:~$ cat /home/dpchrist/sandbox/perl5/shared-program.dat
write bye, dave!
write yada yada


But, those other user can also trash the data file directly:

tinkywinky@tinkywinky:~$ echo "Muahahahahaha"  > 
/home/dpchrist/sandbox/perl5/shared-program.dat

tinkywinky@tinkywinky:~$ cat /home/dpchrist/sandbox/perl5/shared-program.dat
Muahahahahaha


This is situation the OP wants to avoid.


David

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to set access permissions to protect a database file? Markos <markos@c2o.pro.br> - 2019-05-26 02:20 +0200
  Re: How to set access permissions to protect a database file? David Christensen <dpchrist@holgerdanske.com> - 2019-05-26 05:20 +0200
  Re: How to set access permissions to protect a database file? mick crane <mick.crane@gmail.com> - 2019-05-26 05:20 +0200
    Re: How to set access permissions to protect a database file? David Christensen <dpchrist@holgerdanske.com> - 2019-05-26 06:40 +0200
      Re: How to set access permissions to protect a database file? mick crane <mick.crane@gmail.com> - 2019-05-26 07:10 +0200
        Re: How to set access permissions to protect a database file? Markos <markos@c2o.pro.br> - 2019-06-10 00:00 +0200
          Re: How to set access permissions to protect a database file? mick crane <mick.crane@gmail.com> - 2019-06-10 00:40 +0200
          Re: How to set access permissions to protect a database file? Reco <recoverym4n@enotuniq.net> - 2019-06-10 08:00 +0200
            Re: How to set access permissions to protect a database file? john doe <johndoe65534@mail.com> - 2019-06-10 10:40 +0200
          Re: How to set access permissions to protect a database file? David Christensen <dpchrist@holgerdanske.com> - 2019-06-11 05:00 +0200
  Re: How to set access permissions to protect a database file? Joe <joe@jretrading.com> - 2019-05-26 10:20 +0200
    Re: How to set access permissions to protect a database file? Dan Ritter <dsr@randomstring.org> - 2019-06-10 01:10 +0200

csiph-web