The preconditions are somewhat complex, so here is the context:There is a program, that is launched through a shell script;The shell script launches the program through a .jar file;I want this program to store its cache in a /var/opt/ subfolder, say /var/opt/program/;The cache content should not be accessible directly, only through the programThe program should be available for all local users in a systemThe main idea I came up with is to create a group that has all required permissions to read and edit content of the cache folder. I don't want to add users to the group manually, so was looking for alternative options. If I understand it right, the setgid bit should suit me perfectly. My understanding as follows:A folder with the setgid bit set force all its content to have the same owner group, as the folder has and force all its subfolders to follow the same rules. In the meantime it doesn't provide any extra permissions for the those not included in the folder owner group, that is, folder with mask drwxrws--x does not allow others to edit and read its content.A program with the setgid bit set always run on behalf of the owner group, allowing users to perform actions respecting group permissions.My steps as follows:I created a group mygroup;I created a folder /var/opt/program/ and set its owner group to mygroup;I set setgid bit for the folderI set the program shells script owner group to mygroup;I set setgid bit for the shell scriptThe problem is that the program is not able to create and edit files in the cache folder being launched by a user without root permissions. Any advice will be appreciated. UPD Environment:OS: Ubuntu 16.04.2 LTS
How to set setgid bit for a program to allow it change its group folder?
permissions;setgid
A folder with the setgid bit set force all its content to have the same owner group as the folderYep. Newly created files get the group of the directory, the group of the file can of course be changed afterwards. (We call them directories, not folders.)A program with the setgid bit set always run on behalf of the owner groupYep. Though you don't need setgid on the directory if you're only creating files through a setgid binary. A setgid program gets the group in question as the primary group, so any files it creates are owned by that group by default (and not the calling user's group).I set setgid bit for the shell scriptThis is the part that doesn't work. Most systems don't respect setuid and setgid bits on interpreted scripts, since it easily leads to a number of security issues.What you need to do, is to write a C program wrapper that executes the script, and make the wrapper setgid; or (preferably) use something like sudo to allow your users to run the script with the rights of another group. (sudo already deals with things like cleaning up environment variables that might be problematic.) In both cases, make sure the script and its interpreter are in directories that the users can't modify.For sudo, the required configuration (in /etc/sudoers) would be something like this:username ALL=(:privgroup) /path/to/scriptThat would allow user username to run /path/to/script as the group privgroup. You could use %groupname instead of username to allow all members of groupname to run the script. The users will need to run the script using sudo -g privgroup /path/to/script because sudo by default tries to run the named command as root, and we didn't allow that. But you can write a wrapper for that command.