From owner-freebsd-questions@FreeBSD.ORG  Mon Jan  8 19:55:12 2007
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 388DE16A40F
	for <freebsd-questions@freebsd.org>;
	Mon,  8 Jan 2007 19:55:12 +0000 (UTC)
	(envelope-from brett@net24.co.nz)
Received: from srv.exchange.net24.net.nz (srv.exchange.net24.net.nz
	[210.55.4.16]) by mx1.freebsd.org (Postfix) with ESMTP id A8F0013C46A
	for <freebsd-questions@freebsd.org>;
	Mon,  8 Jan 2007 19:55:11 +0000 (UTC)
	(envelope-from brett@net24.co.nz)
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Tue, 9 Jan 2007 08:43:11 +1300
Message-ID: <60224D09909C0B43A50935A0893D8FF31DA320@srv.exchange.net24.net.nz>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Permissions advice needed.
Thread-Index: AccvZyrdAXwE7yfhSGmoz14hj+x9XgD9SZYg
From: "Brett Davidson" <brett@net24.co.nz>
To: <freebsd-questions@freebsd.org>
Subject: Permissions advice needed.
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Jan 2007 19:55:12 -0000

I have a curious problem.

I need an executable file to be owned by a user's uid and gid so they
can run it.
HOWEVER, I don't want them to be able to modify or delete the file
and/or it's permissions. Another program will do that.

This, under standard Unix permissions, is a tad difficult. :-)

ACL's don't help here as the owner of a file has the ability to change
permissions.

I could set the immutable bit (Linux term for the schg flag) but the
modifying program does not recognise this flag and will thus fail to
modify the file.
(I have no control over the modifying program).

Any ideas?

I don't want to go down the line of using BSD MAC but I'm starting to
think I may have too just to be able to prevent the user from modifying
ONE file! (I'm not even sure I could implement this using MAC anyway).

Cheers,
Brett.