[K12OSN] Dropbox directory permissions

[James P. Kinney III]

On Sun, 2007-03-04 at 16:36 -0800, Robert Arkiletian wrote:
> mkdir /home/inbox
> chmod 1773 /home/inbox  (Not readable by others and sticky bit
> prevents overwriting)
> 
> But if a clever kid happens to know the filename of another kid
> 
> cp /home/inbox/filename ~
> 
> unfortunately works. Not good.
> ==============================
> My solution:
> Write a 1 line bashscript /usr/bin/handin
> 
> cp -p $1 /home/inbox/
> 
> chgrp teacher /usr/bin/handin
> chmod 2755 /usr/bin/handin   (setgid escalate priviliges to teacher group)
> 
> now
> 
> chgrp teacher /home/inbox
> chmod 1770 /home/inbox
> 
> To hand-in a test students go
> handin filename
> 
> But it does not work. I get
> 
> cp: cannot stat `/home/inbox/filename': Permission denied
> 
> Why? Apparently, setgid cannot change the group of the process to one
> which you don't already belong to. So I have to add the teacher group
> to all students, which defeats the purpose. So much for privilege
> escalation of setgid. I even tried using setuid.
> 
> [root at server ~]# ls -ld /home/inbox/
> drwxrwx--T  2 root root 4096 Mar  4 16:02 /home/inbox/
> [root at server ~]# ls -l /usr/bin/handin
> -rwsr-xr-x  1 root root 79 Mar  3 14:40 /usr/bin/handin
> 
> I get the same stat Permission denied error. Any suggestions?

I haven't tinkered with it yet, but there is a tool in RH based systems
called fad - file access daemon. That know when a new file appears.
Maybe that can be used to chmod 700 the new files in the drop box. 
> 
> 
-- 
James P. Kinney III          
CEO & Director of Engineering 
Local Net Solutions,LLC        
770-493-8244                    
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/k12osn/attachments/20070305/8370f225/attachment.sig>