Linux:更改文件所有权而不复制吗? [英] Linux: changing file ownership without a copy?

问题描述

我有一个REST服务器，其目的是组织各种用户生成的文件.为了简单起见，服务器和用户都可以访问共享的网络文件系统.

I have a REST server whose purpose is to organize files generated by various users. To keep things simple, both the server and the users have access to a shared network filesystem.

工作流程如下:用户在temp文件夹中生成文件.然后，他通知服务器，然后服务器将文件放在自己的位置，并将一些元数据存储在数据库中.然后，服务器应拥有这些文件，并根据需要删除它们.

The workflow is as follows: the user generates the file in a temp folder. He then notifies the server who then puts the file in a place of its own and stores some metadata in a database. The server should then own the files and take care of their deletion as needed.

我的问题如下:由于文件可能很大，因此我想避免进行昂贵的复制，而只是将文件从temp文件夹移至其最终目的地.但是，移动文件会阻止服务器更改其所有权(请参阅例如).

My problem is the following: since the files can be quite big, I'd like to avoid a costly copy and instead simply move the files from the temp folder to their final destination. However, moving the files prevents the server from changing their ownership (see here for example).

是否可以解决此问题，而无需1)复制文件，以及2)以root用户身份运行服务器?

Is there a way around this, without 1) copying the file, and 2)running the server as root?

几种精度:

• 要移动的文件可以是具有文件层次结构的目录
• 最好让服务器在最终位置拥有文件以限制对其他用户的访问.

推荐答案

如果您创建一个单独的用户来处理chown，则可以为该用户提供CAP_CHOWN功能，并且您可以拥有该用户拥有的单个可执行文件，上面设置了setuid位(因此它以该用户身份执行).

If you create a separate user just to handle the chown, you can give that user the CAP_CHOWN capability, and you can have a single executable owned by that user that has the setuid bit set on it (so it executes as that user).

为了安全起见，此可执行文件应该做的越少越好，并进行尽可能多的检查.

For security, this executable should do as little as possible, with as many checks as possible.

服务器用户执行移动操作后，应该为服务器用户执行chown.它应该存在于其他用户不可写的目录中；它可以进行检查以确保它对被要求销毁的文件的所有属性(当前所有者，位置等)感到满意，可以对服务器用户进行硬编码(因此没有其他人可以使用它)，等

It should do the chown for the server user after the server user does the move. It should exist in a directory that is not writable by other users; it can do checks to insure that it is happy with all the attributes of the files it is asked to chown (current owner, location, etc.), it can have the server user hard-coded (so nobody else can use it), etc.

这可能必须是一个小型C程序，因为大多数系统不允许您将setuid与脚本一起使用.您可以在网上找到几个执行chown的小型示例程序，其中一个是此处

This will probably have to be a small C program, since most systems don't let you use setuid with scripts. You can find several small example programs on the web that do chown -- one is here

这篇关于Linux:更改文件所有权而不复制吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！