Skip to content

Latest commit

 

History

History
391 lines (283 loc) · 17.1 KB

ch09.md

File metadata and controls

391 lines (283 loc) · 17.1 KB

Chapter 9

Commands

  • id - Display user identity.
  • chmod - Change a file’s mode.
  • umask - Set the default file permissions.
  • su - Run a shell as another user.
  • sudo - Execute a command as another user.
  • chown - Change a file’s owner.
  • chgrp - Change a file’s group ownership.
  • passwd - Change a user’s password

Owners, Group Members, and Everybody Else

In the Unix security model, a user may own files and directories. When a user owns a file or directory, the user has control over its access. Users can, in turn, belong to a group consisting of one or more users who are given access to files and directories by their owners. In addition to granting access to a group, an owner may also grant some set of access rights to everybody, which in Unix terms is referred to as the world.

himanshu in ~: id
uid=1000(himanshu) gid=1000(himanshu) groups=1000(himanshu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),120(lpadmin),131(lxd),132(sambashare)

When user accounts are created, users are assigned a number called a user ID, or uid. This is then, for the sake of the humans, mapped to a username. The user is assigned a primary group ID, or gid, and may belong to additional groups.

User accounts are defined in the /etc/passwd file, and groups are defined in the /etc/group file. When user accounts and groups are created, these files are modified along with /etc/shadow, which holds information about the user’s password. For each user account, the /etc/passwd file defines the user (login) name, the uid, the gid, the account’s real name, the home directory, and the login shell. If you examine the contents of /etc/passwd and /etc/group, you will notice that besides the regular user accounts there are accounts for the superuser (uid 0) and various other system users.

Reading, Writing, and Executing

Access rights to files and directories are defined in terms of read access, write access, and execution access.

himanshu in practice: ls
dir1  dir2  fun-hard  ls.txt  New_File.txt  UserInput.txt
himanshu in practice: ls -l ls.txt 
-rw-rw-r-- 1 himanshu himanshu 63 Apr 11 15:22 ls.txt

The first 10 characters of the listing are the file attributes. The first of these characters is the file type. The remaining nine characters of the file attributes, called the file mode, represent the read, write, and execute permissions for the file’s owner, the file’s group owner, and everybody else.

File Types

  • - A regular file.
  • d A directory.
  • l A symbolic link.
    (Notice that with symbolic links, the remaining file attributes are always rwxrwxrwx and are dummy values. The real file attributes are those of the file the symbolic link points to.)
  • c A character special file.
    (This file type refers to a device that handles data as a stream of bytes, such as a terminal or modem.)
  • b A block special file.
    (This file type refers to a device that handles data in blocks, such as a hard drive or CD-ROM drive.)

Permission Attributes

  • r

    File: Allows a file to be opened and read.

    Dir: Allows a directory’s contents to be listed if the execute attribute is also set.

  • w

    File: Allows a file to be written to or truncated; however, this attribute does not allow files to be renamed or deleted. The ability to delete or rename files is determined by directory attributes.

    Dir: Allows files within a directory to be created, deleted, and renamed if the execute attribute is also set.

  • x

    File: Allows a file to be treated as a program and executed. Program files written in scripting languages must also be set as readable to be executed.

    Dir: Allows a directory to be entered; e.g., cd directory.

Permission Attribute Examples

  • -rwx------
    A regular file that is readable, writable, and executable by the file’s owner. No one else has any access.

  • -rw-------
    A regular file that is readable and writable by the file’s owner. No one else has any access.

  • -rw-r--r--
    A regular file that is readable and writable by the file’s owner. Members of the file’s owner group may read the file. The file is world readable.

  • -rwxr-xr-x
    A regular file that is readable, writable, and executable by the file’s owner. The file may be read and executed by everybody else.

  • -rw-rw----
    A regular file that is readable and writable by the file’s owner and members of the file’s owner group only.

  • Lrwxrwxrwx
    A symbolic link. All symbolic links have “dummy” permissions. The real permissions are kept with the actual file pointed to by the symbolic link.

  • drwxrwx---
    A directory. The owner and the members of the owner group may enter the directory and create, rename, and remove files within the directory.

  • drwxr-x---
    A directory. The owner may enter the directory and create, rename, and delete files within the directory. Members of the owner group may enter the directory but cannot create, delete, or rename files

chmod - Change File Mode/Permissions

Be aware that only the file’s owner or the superuser can change the mode of a file or directory. chmod supports two distinct ways of specifying mode changes: octal number representation and symbolic representation

File Modes in Binary and Octal

Octal Binary File Mode
0 000 ---
1 001 --x
2 010 -w-
3 011 -wx
4 100 r--
5 101 r-x
6 110 rw-
7 111 rwx 
himanshu in practice: ls -l ls.txt 
-rw-rw-r-- 1 himanshu himanshu 63 Apr 11 15:22 ls.txt
himanshu in practice: chmod 600 ls.txt 
himanshu in practice: ls -l ls.txt 
-rw------- 1 himanshu himanshu 63 Apr 11 15:22 ls.txt

Symbolic Representation

chmod also supports a symbolic notation for specifying file modes. Symbolic notation is divided into three parts: whom the change will affect, which operation will be performed, and which permission will be set. To specify who is affected, a combination of the characters u, g, o, and a is used.

  • u Short for user but means the file or directory owner.
  • g Group owner.
  • o Short for others but means world.
  • a Short for all; the combination of u, g, and o.

If no character is specified, all will be assumed. The operation may be a + indicating that a permission is to be added, a - indicating that a permission is to be taken away, or a = indicating that only the specified permissions are to be applied and that all others are to be removed. Permissions are specified with the r, w, and x characters.

  • u+x Add execute permission for the owner.
  • u-x Remove execute permission from the owner.
  • +x Add execute permission for the owner, group, and world. Equivalent to a+x.
  • o-rw Remove the read and write permissions from anyone besides the owner and group owner.
  • go=rw Set the group owner and anyone besides the owner to have read and write permission. If either the group owner or world previously had execute permissions, remove them.
  • u+x,go=rx Add execute permission for the owner and set the permissions for the group and others to read and execute. Multiple specifications may be separated by commas.

umask - Set Default Permissions

The umask command controls the default permissions given to a file when it is created. It uses octal notation to express a mask of bits to be removed from a file’s mode attributes. Most of the time you won’t have to change the mask; the default provided by your distribution will be fine.

maks = 0002

Original file mode --- rw- rw- rw-
Mask 000 000 000 010
Result --- rw- rw- r--

Observe that where the 1 appears in our mask, an attribute was removed—in this case, the world write permission. That’s what the mask does.

himanshu in practice: umask         #check the current value of umask
0002
himanshu in practice: umask 0002    # set mask to desired value (default)
himanshu in practice: umask         # check again
0002

We already have a file ls.txt lets remove it.

himanshu in practice: ls
dir1  dir2  fun-hard  ls.txt  New_File.txt  UserInput.txt
himanshu in practice: ls -l ls.txt 
-rw------- 1 himanshu himanshu 63 Apr 11 15:22 ls.txt
himanshu in practice: rm ls.txt 
himanshu in practice: ls -l ls.txt 
ls: cannot access 'ls.txt': No such file or directory

Now regenerate it and see the default permission get assigned to file from umask.

himanshu in practice: ls > ls.txt
himanshu in practice: ls -l ls.txt 
-rw-rw-r-- 1 himanshu himanshu 53 Apr 15 15:09 ls.txt

Changing umask to 0000 (off) and recreating files.

himanshu in practice: umask 0000
himanshu in practice: umask
0000
himanshu in practice: rm ls.txt 
himanshu in practice: ls
dir1  dir2  fun-hard  New_File.txt  UserInput.txt
himanshu in practice: ls > ls.txt
himanshu in practice: ls -l ls.txt 
-rw-rw-rw- 1 himanshu himanshu 53 Apr 15 15:12 ls.txt

See the difference in permission this time. World can read and write as well. Restore the umask.

himanshu in practice: umask 0002
himanshu in practice: umask
0002

Changing Identities

There are three ways to take on an alternate identity:

  • Log out and log back in as the alternate user.
  • Use the su command.
  • Use the sudo command.

From within your own shell session, the su command allows you to assume the identity of another user and either start a new shell session with that user’s ID or issue a single command as that user.

The sudo command allows an administrator to set up a configuration file called /etc/sudoers and define specific commands that particular users are permitted to execute under an assumed identity.

himanshu in practice: id
uid=1000(himanshu) gid=1000(himanshu) groups=1000(himanshu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),120(lpadmin),131(lxd),132(sambashare)
himanshu in practice: sudo su
root@workstation:/home/himanshu/HP/practice# id
uid=0(root) gid=0(root) groups=0(root)
root@workstation:/home/himanshu/HP/practice# exit
exit
himanshu in practice:

Executing a single command instead of login as superuser sudo <command>

himanshu in practice: sudo ls
dir1  dir2  fun-hard  ls.txt  New_File.txt  UserInput.txt

Difference in sudo and su

One important difference is that the use of sudo does not require access to the superuser’s password. To authenticate using sudo, the user enters his own password. While in su user enters password of user who user want to login as.

Another the administrator can configure sudo to allow an ordinary user to execute commands as a different user (usually the superuser) in a very controlled way. In particular, a user may be restricted to one or more specific commands and no others.

One important difference between su and sudo is that sudo does not start a new shell, nor does it load another user’s environment.

To see what privileges are granted by sudo, use the -l option to list them.

himanshu in practice: sudo -l
Matching Defaults entries for himanshu on workstation:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User himanshu may run the following commands on workstation:
    (ALL : ALL) ALL

chown - Change File Owner and Group

The chown command is used to change the owner and group owner of a file or directory. Superuser privileges are required to use this command. The syntax of chown looks like this:

chown [owner][:[group]] file...

  • chown bob Changes the ownership of the file from its current owner to user bob.

  • chown bob:users Changes the ownership of the file from its current owner to user bob and changes the file group owner to group users.

  • chown :admins Changes the group owner to the group admins. The file owner is unchanged.

  • chown bob: Change the file owner from the current owner to user bob and changes the group owner to the login group of user bob.

User janet wants to copy a file from her home directory to the home directory of user tony. Since user janet wants tony to be able to edit the file, janet changes the ownership of the copied file from janet to tony:

[janet@linuxbox ~]$ sudo cp myfile.txt ~tony
Password:
[janet@linuxbox ~]$ sudo ls -l ~tony/myfile.txt
-rw-r--r-- 1 root root 8031 2012-03-20 14:30 /home/tony/myfile.txt
[janet@linuxbox ~]$ sudo chown tony: ~tony/myfile.txt
[janet@linuxbox ~]$ sudo ls -l ~tony/myfile.txt
-rw-r--r-- 1 tony tony 8031 2012-03-20 14:30 /home/tony/myfile.txt

chgrp - Change Group Ownership

In older versions of Unix, the chown command changed only file ownership, not group ownership. For that purpose a separate command, chgrp, was used.

Exercising Your Privileges

Setting up a shared directory. Let’s imagine that we have two users named bill and karen. User bill has access to superuser privileges via sudo.

  1. The first thing that needs to happen is the creation of a group that will have both bill and karen as members. Using GNOME’s graphical user management tool, bill creates a group called music and adds users bill and karen to it.

    $ sudo groupadd new_group           # create a group
$ sudo adduser user_name new_group # add user to group
$ sudo groupdel new_group           # delete a group

  2. bill creates a group called music and adds users bill and karen.

    sudo groupadd music
sudo adduser karen,bill music

  3. bill creates the directory for the music files. Since bill is manipulating files outside his home directory, superuser privileges are required.

    [bill@linuxbox ~]$ sudo mkdir /usr/local/share/Music
Password:

  4. After the directory is created, it has the following ownerships and permissions:

    [bill@linuxbox ~]$ ls -ld /usr/local/share/Music
drwxr-xr-x 2 root root 4096 2012-03-21 18:05 /usr/local/share/Music

  5. As we can see, the directory is owned by root and has 755 permissions. To make this directory shareable, bill needs to change the group ownership and the group permissions to allow writing:

    [bill@linuxbox ~]$ sudo chown :music /usr/local/share/Music
[bill@linuxbox ~]$ sudo chmod 775 /usr/local/share/Music
[bill@linuxbox ~]$ ls -ld /usr/local/share/Music
drwxrwxr-x 2 root music 4096 2012-03-21 18:05 /usr/local/share/Music

It means that we now have a directory /usr/local/share/Music that is owned by root and allows read and write access to group music. Group music has members bill and karen; thus bill and karen can create files in directory /usr/local/share/Music. Other users can list the contents of the directory but cannot create files there

But we still have a problem. With the current permissions, files and directories created within the Music directory will have the normal permissions of the users bill and karen.

[bill@linuxbox ~]$ > /usr/local/share/Music/test_file
[bill@linuxbox ~]$ ls -l /usr/local/share/Music
-rw-r--r-- 1 bill bill 0 2012-03-24 20:03 test_file

This would not be a problem if the shared directory contained only files, but since this directory will store music and music is usually organized in a hierarchy of artists and albums, members of the group will need the ability to create files and directories inside directories created by other members. We need to change the umask used by bill and karen to 0002 instead.

Second, each file and directory created by one member will be set to the primary group of the user, rather than the group music. This can be fixed by setting the setgid bit on the directory.

[bill@linuxbox ~]$ sudo chmod g+s /usr/local/share/Music
[bill@linuxbox ~]$ ls -ld /usr/local/share/Music
drwxrwsr-x 2 root music 4096 2012-03-24 20:03 /usr/local/share/Music

Now we test to see if the new permissions fix the problem. bill sets his umask to 0002, removes the previous test file, and creates a new test file and directory.

[bill@linuxbox ~]$ umask 0002
[bill@linuxbox ~]$ rm /usr/local/share/Music/test_file
[bill@linuxbox ~]$ > /usr/local/share/Music/test_file
[bill@linuxbox ~]$ mkdir /usr/local/share/Music/test_dir
[bill@linuxbox ~]$ ls -l /usr/local/share/Music
drwxrwsr-x 2 bill music 4096 2012-03-24 20:24 test_dir
-rw-rw-r-- 1 bill music 0 2012-03-24 20:22 test_file
[bill@linuxbox ~]$

Both files and directories are now created with the correct permissions to allow all members of the group music to create files and directories inside the Music directory.

Changing Your Password

The command syntax looks like this: passwd [user]

himanshu in practice: passwd
Changing password for himanshu.
Current password: 
New password: 
Retype new password: 
You must choose a longer password

If you have superuser privileges, you can specify a username as an argument to the passwd command to set the password for another user. Other options are available to the superuser to allow account locking, password expiration, and so on. See the passwd man page for details.

himanshu in practice: passwd himanshu
Changing password for himanshu.
Current password: