Required default permission as execute in OS level for files generating from Application side

[SAPSupport]

Hello SAP Team,

We have developed a custom program which is generating few files at OS level with default read/write (-rw-rw----) permissions and later those files are picked by CPI interface (Cloud platform integration) via cloud connector.

We are using cloud connector as a middleware between CPI and on premise ECC system and all the connections are working fine with a generic user which we have created for SFTP from CPI to ECC system.

Currently we are facing issue where SFTP user is not able to execute the files placed in OS directory from CPI end as those are generating with read/write permissions and we have to manually provide execute permission to execute the entire workflow.

Is there any way where we can provide by default execute permission (775 or 755) to newly generated files whenever the program is running and the files will be generated with execute permission so that SFTP user can perform the necessary action to complete the workflow.

Currently we have a workaround where we have setup a cronjob at OS end at interval of 30 mins which is providing 775 permission to all files generating inside the source directory so that SFTP user can perform execute action on those.

Please assist if there is any possible way where we can restrict the files at OS end to generate with default 775 or 755 permission.

Regards,

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

[SAPSupport · Accepted solution]

To ensure that newly generated files have the desired permissions (775 or 755) by default, you can use several approaches. Here are a few methods you can consider:

1. Modify the Program to Set Permissions

If you have control over the custom program that generates the files, you can modify it to set the desired permissions when creating the files. In most programming languages, there are functions or methods to set file permissions.

For example, in Python, you can use os.chmod to set the file permissions:

import os

# Create the file
file_path = 'path/to/your/file'
with open(file_path, 'w') as file:
    file.write('Your content here')

# Set the file permissions to 755
os.chmod(file_path, 0o755)

2. Use umask to Set Default Permissions

The umask command in Unix-like operating systems can be used to set default file creation permissions. You can set the umask value in the shell or script that runs your program.

For example, to set the default permissions to 775, you can set the umask to 002:

umask 002

To set the default permissions to 755, you can set the umask to 022:

umask 022

You can add this umask command to the script that runs your program or to the shell profile (e.g., .bashrc or .profile) of the user running the program.

3. Use chmod in a Post-Processing Script

If modifying the program or using umask is not feasible, you can create a post-processing script that changes the permissions of the files immediately after they are created. This script can be triggered by the program itself or run as a cron job with a shorter interval.

For example, you can create a script set_permissions.sh:

#!/bin/bash
# Directory where files are generated
DIR="/path/to/your/directory"

# Change permissions of all files in the directory to 755
chmod 755 $DIR/*

You can then run this script immediately after your program finishes generating the files.

4. Use inotify to Monitor and Change Permissions

On Linux systems, you can use inotify to monitor the directory for new files and change their permissions as soon as they are created. This approach is more efficient than using a cron job.

You can use a tool like inotifywait from the inotify-tools package:

#!/bin/bash
# Directory to monitor
DIR="/path/to/your/directory"

# Monitor the directory for new files and change their permissions
inotifywait -m -e create "$DIR" | while read path action file; do
    chmod 755 "$DIR/$file"
done

Summary

• Modify the program to set the desired permissions when creating files.
• Use umask to set default file creation permissions.
• Use a post-processing script to change permissions immediately after file creation.
• Use inotify to monitor the directory and change permissions in real-time.

Choose the method that best fits your environment and constraints.