On a shared data server where I don't have sudo, how can lab assistants give me ownership of files they upload?
My team uses a shared department CentOS server for most of our data work, and for reasons, we don't have easy access to a sysadmin with root permissions. A typical workflow is that lab techs collect and upload data to folders I own, and I handle data organization (including moving and renaming files, and changing permissions of primary data to read-only for safety). Linux/Mac users normally upload data using rsync -avz; Windows users use Moba which I think uses SFTP protocol.
The problem is that when a user uploads a file, it automatically belongs to them. I normally have them change the permissions to 777 so I can at least move and rename files (which is an annoyance, as most lab techs aren't super comfortable with the command line). But that still doesn't let me change permissions to read-only, meaning that anyone (including me) could delete those files by accident. My ugly workaround so far has been to copy the files so that I own the new files, then delete the old ones.
What's the right way for all of us to upload files so that I own the files afterwards?
Posted Jun 2, 2022, 4:58 PM UTC
If can have sysadmin set group of root folder for these files it might be a job for setgid. Newly created files and subdirectories will inherit parent directory group.
From wikipedia
"Setting the setgid permission on a directory ("chmod g+s") causes new files and subdirectories created within it to inherit its group ID, rather than the primary group ID of the user who created the file (the owner ID is never affected, only the group ID)."
https://en.wikipedia.org/wiki/Setgid
Edited link to Setgid although setuid and setgid shares page on wikipedia
In any medium to large organization setuid and 777 will be out of the question. There are simply too many security issues related to those, and in any company which is bound by SOX, you'll run into issues with controls/compliance if they are in-use.
The proper and normal way to handle this is to have the group set automatically for the directory as askgio mentions which you are both a member of. Still same issue with others in the same group deleting things as the group has effectively the same permissions.
The only other way would be for the system admins to enable/roll out ACLs and that allows you to have multiple groups that can be assigned to a single file with different permissions (which has enough flexibility so that it can be done compliant with Sarbanes Oxley.
Obligatory Disclaimer: This is not legal advice, I am not a lawyer
Edit: Redhat ACL's.