Question

I’m sharing a git repository with a colleague, and because git does not propagate the full panoply of Unix file permissions, we have a “hook” that runs on update which sets the ‘other’ permissions as they need to be set. The problem? The hook uses chmod, and it turns out that when my colleague commits a file, he owns it, so I can’t run chmod on it, and vice versa. The directories are all group writable, sticky, so I believe that either of us has the right to remove any file and replace it with one of the same name, same contents, but different ownership. Presumably then we could chmod it. But this seems like an awfully big hammer, and I’m a bit leery of screwing it up. So, two questions:

1. Can anybody think of another way to do it?

2. If not, what’s the best design for a bulletproof shell script that implements “make this file belong to me”? No cross-filesystem moves, etc etc…

For those who may not have realized, write permission does not confer permission to chmod:

% ls -l value.c
-rw-rw---- 1 agallant ta105 133 Feb 10 13:37 value.c
% [ -w value.c ] && echo writeable
writeable
% chmod o+r value.c               
chmod: changing permissions of `value.c': Operation not permitted

We are both in the ta105 group.

---

Notes:

1. We’re using git not only to coordinate changes but to publish the repo as a course web site. Publishing the web site is the primary purpose of the repo. The permissions script runs at every update using a git hook, and it ensures that students do not have permission to read solutions that have not yet been unveiled.

2. Please do not suggest that I have the wrong umask. Not all files in the repo should have the same permissions, and whatever umask is chosen, permissions on some files will need to be changed. Not to mention that it would be discourteous for me to impose my umask preferences on my colleagues.

3. UPDATE: I’ve just learned that in our environment, root is quashed to nobody on all machines we have access to, so that a solution which relies on root privileges won’t work.

Answer 1

There is at least one Unix in which I’ve seen a way to give someone chmod and chown permissions on all files owned by a particular group. This is sometimes called “group superuser” or something similar.

The only Unix I’m positive I’ve seen this on was the version of Unix that the Encore Multimax ran.

I’ve searched a bit, and while I remember a few vague references to an ability of this sort in Linux, I have been unable to find them. So this may not be an option. Luckily, it can be simulated, albeit the simulation is a bit dangerous.

The way to simulate this is to make a very specific suid program that will do the chmod as root after checking that you are a member of the same group as owns the file, and your username is listed as having that permission in a special /etc/chmod_group file that must be owned by root and readable and writeable only by root.