Arch Linux

RootGroot

Member

Registered: 2018-05-27

Posts: 1

Program Permissions and how to create

If I create user specific configuration files that may have sensitive data inside of them, how can I secure those config files to only be readable by the application and have rw permissions by the owner.

I considered creating a specific group for the application and changing the group owner of these config files to that. It seems like a scalable solution since any new user will only need to change the group and this application will be able to read it.

However I cannot seem to find documentation to start a program with a specific created group (persistently hopefully) or to always assign this program these permissions.

I like this idea a lot but I would rather have the standard solution to this issue.

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 30,543

Website

Re: Program Permissions and how to create

Can you be more specific?  Why would you not just create the files with 0500 permissions and be done with it.

---

"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: Program Permissions and how to create

Applications by default start with the UID/GID of the user executing them unless setuid/setgid or some other mechanism is used to change the executable's UID/GID.
Edit:
additional group memberships are also inherited which would be important in your use case.

Last edited by loqs (2018-05-27 20:50:20)

progandy

Member

Registered: 2012-05-17

Posts: 5,322

Re: Program Permissions and how to create

What loqs said.

Other alternatives would be to containerize your application or use AppArmor or SELinux to restrict permissions, but in my opinion, simply restricting the permissions to the owner should be enough in most cases.

Last edited by progandy (2018-05-27 21:11:17)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |