Red Hat

Who do you want to be able to do this? Not just anyone should be able to. There must be reasons this is restricted, it shouldn't be done in a way that allows anyone to do so. Would making a group of users who're allowed to use this tool be okay?

Hi,

the application handles somethings and all users allowed to run the application should be able to change the date and time. So, when the file is created, the owner is one, but I need to update the date and time, according to some rules on the application, and the solution was to use the touch command.Note: everyone that is allowed to run the application, belongs to the same group.

user1 - group app1
user2 - group app1

The process:

user1 creates a file - xxx.txt, today - 20150109 10:10....

tomorrow, the user2 running the application, for example, he accesses the file xxx.txt by the application, so, for my control and my reason, I need to change the date and time. note: if the user1 tries to read the file xxx.txt, it works - the touch command, because the owner is the same.

today, the application issues the touch command with 2 parameters: the date/time and the folder+filename. (parameters: 201501100830 /xxx/yyy/zzz/xxx.txt), the final command is: touch -c -t 201501100830 /xxx/yyy/zzz/xxx.txt

If the solution is to run as root, I will need to do it. Of course, if there is other way to do it, and with safety, I would like to know,

One way to use your script, considering dynamic user, is the application read before the owner, and instead of use the touch command, it would be used your script with 3 parameters: the owner, the date/time and the folder+filename.

would it be a solution? on sudo statement in your script, would the password be requested? if so, it would be not the solution. I need to avoid any interactive session.

if I understood the idea of your script, the folder where the script will be stored, it will be always the same, but the folder and the filename where the date/time will be changed, not.

Please, let me know if it is clear and if there would be a solution for me.

tks.

Okay. That helps a lot. Just be sure to take a good look at what's inside the 'app1' group. You don't want people to be able to touch root's timestamps, etc. You may find a few users you you should specifically prevent them from running as.

Code:

# sudoers file

%app1 ALL=(%app1) NOPASSWD:  /path/to/update-time.sh

This would allow anyone in the app1 group to run /path/to/update-time.sh as any other user in the app1 group. Still no need to risk giving anyone root.

So:

Code:

#!/bin/sh

if [ "$#" -ne 2 ]
then
        echo "Usage:  $0 timestamp filename" >&2
        exit 1
fi

if ! [ -e "$2" ]
then
        echo "File $1 does not exist" >&2
        exit 1
fi

# Can also use 'stat' to get this on some systems
NEWUSER="$(ls -l "$1" | awk '{ print $3 }' )"

# If we are not the owner of the file, restart this script from the beginning
# as $NEWUSER via sudo.
[ "$USER" = "$NEWUSER" ] || exec sudo -u "$NEWUSER" "$0" "$@"

# Touch the file with an arbitrary timestamp.
touch -c -t "$1" "$2"

Hi Corona688,

thank you very much for the code.

I am not an expert on Linux and script, so, could you please explain better the statements above? I am not sure what I need to do when you say: restart this script from the beginning as $NEWUSER via sudo.

I thought that the script should executed at once, no matter the owner. Even I need to execute the script again how to execute the script as sudo, how would it be? Just remembering, the application will send to Linux the script execution, and the execution needs to be at once - there is no interactive session to execute the script, I am not able to send to Linux 2 commands, just 1.

what happen if I always consider that the user/owner is different and sudo is always executed? (even if I could have the owner as the user)

tks.

Hi Corona688,

I have tested the code, and it worked, and I did not need to change/start when the user is not the owner. Perfect!!!. I just had to adjust part of the code below, because I assumed that the Parm 1 is the date and Parm 2 is the folder/file.


TO:


Thank you very much for the assistance on this issue.

That exec line is a convenience thing so the user can run /path/to/script.sh instead of sudo -u username /path/to/script.sh. If the user is different, it runs sudo -u username /path/to/script for them. $0 is "/path/to/script.sh" so I don't have to hardcode what the script is named. "$@" is "all arguments, properly quoted". exec means "replace the current script with the command I'm running now" so all the lines below are ignored when the user is wrong.

Sorry about the bug, you've got it figured out.