Linux 在脚本中更改默认组
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/3735858/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Change Default Group in Script
提问by Nate
Is it possible to change a user's default group inside a script for the duration of that script's execution?
是否可以在脚本执行期间更改脚本内用户的默认组？
I need to generate files in a script that have the proper user and group but my user's primary group is not who should own the resultant output.
我需要在具有正确用户和组的脚本中生成文件，但我的用户的主要组不是应该拥有结果输出的人。
$ groups
groupa groupb
$ ./myscript.sh
$ ls -l
-rw-r--r-- 1 me groupa 0 Sep 17 09:42 myscript_output.txt
But I want"groupb".
但我想要“groupb”。
myscript.sh:
我的脚本.sh：
#!/bin/bash
touch "myscript_output.txt"
采纳答案by dogbane
回答by Dummy00001
Normally that can be accomplished by applying to a program the modifications:
通常，这可以通过将修改应用于程序来实现：
chgrp groupb myprog
chmod g+s myprog
But that works with normal programs - not with the shell scripts (for security reasons). For a shell script there is no other way (at least I'm not aware (*)) other than from inside script itself to call the chgrp:
但这适用于普通程序 - 不适用于 shell 脚本（出于安全原因）。对于 shell 脚本，除了从脚本内部调用之外，没有其他方法（至少我不知道 (*)）chgrp：
#!/bin/bash
FNAME="myscript_output.txt"
GRP=groupb
touch $FNAME
chgrp $GRP $FNAME || { echo 2>&1 "Can't change group of $FNAME to $GRP"; exit 1; }
(*) Some people for the purpose write a tiny wrapper C program. But that is kludgy. Search net for "setuid shell scripts" - there would be lots of such example C programs and replace most commonly found there setuid(0)with getgrnam()+ setgid().
(*) 有些人为此编写了一个很小的包装器 C 程序。但这很笨拙。在网上搜索“setuid shell 脚本” - 会有很多这样的示例 C 程序，并setuid(0)用getgrnam()+替换最常见的setgid()。
回答by Nate
The sgcommand can do this pretty well.
该sg命令可以很好地做到这一点。
#!/bin/bash
sg groupb "touch myscript-output.txt"
回答by frayser
The group can be set from a script. It only requires the "if"
statement below. The group is checked and if it is incorrect, then
the script is restarted with the sg command Nate mentioned.
A check for looping is employed(just in case the unforeseeable happens.)
可以从脚本设置组。它只需要下面的“if”语句。检查组，如果不正确，则使用提到的 sg 命令 Nate 重新启动脚本。
使用循环检查（以防发生不可预见的情况。）
To use, just change the group from "wheel" to the desired. Replace the "DEMO" section with the regular code.
要使用，只需将组从“wheel”更改为所需的。用常规代码替换“DEMO”部分。
Read on, below(after the script.)
继续阅读，下面（在脚本之后。）
#! /bin/sh
#
# If the group(set with NEEDGRP) is already correct, or this code has already
# run, then this section is skipped and the rest of the
# script is run; otherwise sg is called to restart the script with the
# desired group. Assumes the command "id -ng" returns the group.
if ! [ "${SBREADY:=false}" = true -o $(id -ng) = ${NEEDGRP:=wheel} ] ; then
export SBREADY=true
exec sg $NEEDGRP "frayser@gentoo ~/src/Answers $ (cd /tmp; $OLDPWD/set-group.sh)
HELLO my group is wheel, GID=10
/tmp
drwxrwxrwt 16 root root 976 Sep 24 04:45 .
Created my-19201.a... my-19201.b... my-19201.c...
-rw-r----- 1 frayser wheel 0 Sep 24 04:53 my-19201.a
-rw-r----- 1 frayser wheel 0 Sep 24 04:53 my-19201.b
-rw-r----- 1 frayser wheel 0 Sep 24 04:53 my-19201.c
removed `my-19201.a'
removed `my-19201.b'
removed `my-19201.c'
" "$@"
fi
# ---------------------- DEMO: CUT HERE ---------------------------
# This is a demonstration of creating files.
echo HELLO my group is $(id -ng), GID=$(id -g)
# NOTE: files are created with the current group only if the directory
# is not sgid.
# Show current directory and permissions on it
echo
pwd -P
ls -ld .
echo
# Create and list some new files, the remove them.
touch my-$$.{a,b,c}
echo Created my-$$.{a,b,c}...
ls -l my-$$.{a,b,c}
echo
rm -v my-$$.{a,b,c}
Following are printouts of some tests run in order to explain why just changing groups my not be sufficient to ensure files have the right group ownership. Directory permissions also come into play.
以下是一些运行测试的打印输出，以解释为什么仅更改组不足以确保文件具有正确的组所有权。目录权限也发挥作用。
This first log is the output from ruining in a regular directory. The script is run as user frayser, and group frayser. Files are created with the desired group. Compare to the next listing:
第一个日志是在常规目录中破坏的输出。该脚本以用户frayser和组frayser 运行。文件是用所需的组创建的。与下一个列表进行比较：
frayser@gentoo ~/src/Answers $ ./set-group.sh
HELLO my group is wheel, GID=10
/usr/lucho/src/frayser/practice
drwxr-s--- 6 frayser conman 768 Sep 24 04:51 .
Created my-19214.a... my-19214.b... my-19214.c...
-rw-r----- 1 frayser conman 0 Sep 24 04:54 my-19214.a
-rw-r----- 1 frayser conman 0 Sep 24 04:54 my-19214.b
-rw-r----- 1 frayser conman 0 Sep 24 04:54 my-19214.c
removed `my-19214.a'
removed `my-19214.b'
removed `my-19214.c'
frayser@gentoo ~/src/Answers $
Now this next run happens in a director that is sgid"conman" because as a policy, Configuration Management is given group ownership of all srcdirectories. NOTE:The files inherit the group of the directory.
现在下一次运行发生在sgid"conman" 的控制器中，因为作为策略，配置管理被授予所有src目录的组所有权。 注意：文件继承目录组。
##代码##Because of directory permissions, it may be necessary for a script to explicitly set permissions and ownership.
由于目录权限，脚本可能需要显式设置权限和所有权。
