Is there a direct way to "send" a file from one user to another in Linux

Question

To clarify for users who think this is a common question... I know how to use an intermediate directory with a common group to transfer a file between two users. In my situation that intermediate file is a security risk. Is there a direct option to share a file?

Scenario

user A has a huge file f1.gz with group g1. This group cannot be modified for security reasons.

user A has groups g1,g2

user B has an area where they want to store that file

user B only has groups g2,g3 (so they share g2 with user A, but not the file's group)

Imagine in this scenario that user A can become user B via an authentication script with the SGID bit set for g2, so user A could actually be the sender and the (impersonated) receiver.

Limitations

sudo su -c is out of the question because this transfer is part of a non-interactive script.

I can't add any groups to user A or user B.

I can't make a directory g2-writable because 1) user A would have access outside the script to freely modify anything in the directory, and 2) there are multiple users involved here in group g2 and I don't want a user C messing with user A's file in the g2-writable directory.

Question

Without having user B create a g2-writable directory where user A can drop the file, is it possible to "send" the file to user B in an efficient way? What are my options?

Ideas

• I've thought about using a remote database, but the file is huge and there are too many users performing the same action too quickly. I also can't expect a local database to keep running without interruption due to machine cycling (only the NFS remains always-available). I'm very much looking for a direct exchange.

• I've also thought about temporarily changing the group of the file, but that is obviously a security issue.

• I've looked at other posts with similar questions, but they don't seem to have the same limitations.

• Some sort of SCP/rsync? But, I can have a key sitting around which allows user A to become user B outside the script.

I'm totally stumped. Any thoughts?

Answer 1

A possible solution is to use a temporary directory both groups have access to, copy the file to that directory as user A, and copy from that directory as user B. Assuming they both have access to /tmp:

userA $ mkdir /tmp/f1
userA $ chown userA:g2 /tmp/f1
userA $ chmod 750 /tmp/f1
userA $ cp path/to/f1.gz /tmp/f1/f1.gz

userB $ cp /tmp/f1/f1.gz /path/to/destination

This would give group g2 read access the file. If this is not desired, you could have userB set up the temp directory with owner userB:g1 and permissions 660, but that would obviously give g1 read access to the file.

/tmp is not necessarily a recommended place to store this, I only recommend it if you don't have permissions to set up a directory elsewhere. /srv is a good alternative. /tmp may be faster if it is mounted in RAM, however.

In terms of direct exchange, I don't see a way to do it without giving userA access outside of the script as well.

EDIT: Another method using sockets:

userA $ mkdir /tmp/f1
userA $ chown userA:g2 /tmp/f1
userA $ chmod 750 /tmp/f1
userA $ mkfifo /tmp/f1/f1.socket
userA $ cp /path/to/f1.gz /tmp/f1/f1.socket

userB $ cp /tmp/f1/f1.socket /path/to/destination

This should improve performance, but there's no way to guaruntee userB is the one reading since anyone in g2 has read perms.