It is Solaris-10. There is a file as /opt/vpp/dom1.2/pdd/today_23. It is always generated by root, so owned by root only.
This file has to be deleted as part of application restart always and that is done by app_user and SA is always involved to do rm on that file.
Is it possible to give rm access to app_user, only to that file, via sudoers ? So that, he can delete only that file, not any other path or file or folder.
I'm willing to bet that when you come back with why the file is written by root it is because the directory /opt/vpp/dom1.2/pdd is owned by root.
dewi(6)$ file xyzzy
xyzzy: cannot open `xyzzy' (No such file or directory)
dewi(7)$ sudo touch xyzzy
[sudo] password for apm:
dewi(8)$ ls -l xyzzy
-rw-r--r-- 1 root root 0 24 Aug 11:29 xyzzy
dewi(9)$ rm xyzzy
rm: remove write-protected regular empty file 'xyzzy'? y
dewi(10)$ ls -l xyzzy
ls: cannot access 'xyzzy': No such file or directory
dewi(11)$ sudo mkdir XYZZY
dewi(12)$ ls -ld XYZZY/
drwxr-xr-x 2 root root 4096 24 Aug 11:31 XYZZY/
dewi(13)$ cd XYZZY/
dewi(14)$ sudo touch xyzzy
dewi(15)$ ls -la
drwxr-xr-x 2 root root 4096 24 Aug 11:32 .
drwxr-xr-x 19 apm sog 4096 24 Aug 11:31 ..
-rw-r--r-- 1 root root 0 24 Aug 11:32 xyzzy
dewi(16)$ rm -f xyzzy
rm: cannot remove 'xyzzy': Permission denied
So because I own the parent directory I was able to deleted the first xyzzy file, but because root owned the directory XYZZY I was unable to delete the second xyzzy file.
So why does the file today_23 need to be created in the directory /opt/vpp/dom1.2/pdd? Can it be created elsewhere? Failing that, could the directory pdd be modified to give the user the required write permission to create and delete the file without root access?
PLEASE NOTICE, though, this does not invalidate what my colleagues have already said about problems, symptoms and patching over them. I just want to tell you that - if every other way of correcting the underlying problem fails - there is a last-ditch solution you could employ. You still should try your utmost to avoid needing that. See also here, which is basically the same principle at work.
I hope this helps.
These 2 Users Gave Thanks to bakunin For This Post: