Talk presented by Kim Oldfield to the Linux Users of Victoria Inc. on Tuesday, December 2, 2003.
/etc/passwd. eg/home/username, but can be anywhere.
To find out your current username and uid, primary group an gid, and
additional groups you are a member of run id.
bash> id uid=1006(kim) gid=1006(kim) groups=1006(kim),4(adm),29(audio)
| Commands | |
|---|---|
chown user file
| Change the owner of file to user |
chown user.group file
| Change file's owner to user and group to group. |
chown can only be used by root.
/etc/group| Commands | |
|---|---|
chgrp group file
| Change file's group to group. |
All of these commands require that you are root. To become root from an
ordinary user run su and enter the root password when
prompted.
| Commands | |
|---|---|
adduser
| Adds a users. You will be prompted for the username, password, full name, and other details. |
vipw
| Edit /etc/password. This locks the file, and does some sanity checking
on your changes before making them permanent. /etc/shadow can be edited with
vipw -s
|
addgroup
| Create a new group. You will be prompted for the name. |
adduser username groupname
| |
| Adds username to the group groupname | |
vigr
| Edit /etc/group. This locks
the file, and does some sanity checking on your changes before making them
permanent. /etc/gshadow can be edited with vigr -s
|
Changes to group membership take place the next time you login.
bash> ls -l /etc/shadow -rw-r----- 1 root shadow 680 Nov 2 18:49 shadow
Each of these characters correspond to type, and permissions for the user, group, and others.
The first '-' indicates that this is a regular file.
'rw-' indicates that the owner of the file (root), is able to read an write to the file. The '-' indicates that root is not allowed to run the file.
'r--' indicates that anyone who is a member of the group 'shadow' is able to read to the file.
'---' indicates that anyone who is not root and not a member of the group 'shadow' (ie 'others') are not able to read or write to the file.
ls shows permissions as a 10 character string, for example
-rw-r--r--. The characters can be interpreted as
TUUUGGGOOO where:
| T | Type |
| UUU | Rights for the owner of the file |
| GGG | Rights for users in the group |
| OOO | Rights for others, not listed above |
T is one of:
| - | file |
| d | directory |
| c | character device |
| b | block device |
| l | symbolic link |
Character and block devices are usually in /dev
The permissions on a symbolic link are always lrwxrwxrwx. This means that anyone can see where the links points. Who can read, write, or execute the file (or directory or device) the link points to is determined by the permissions on that file, not the link.
Each of the permission triplets, UUU, GGG, and OOO, can consist of:
| File permissions: | |
| r | allows reading |
| w | allows writing |
| x | allows execution (*) |
| Directory permissions: | |
| r | allows reading of files, size, etc |
| w | allows creating and deleting of files (see also t below) |
| x | allows access to files and directories below if you take away x that stops access to the directory, files, and all sub directories |
| Commands | |
|---|---|
chmod g+r file | Allow group to read |
chmod u+w file | Allow user to write |
chmod a+x file | Allow everyone (user, group, and other) to execute |
chmod o-r file | Disallow others to read |
chmod ug+r file | Disallow others to read |
chmod g+w,o-r file | Allow group write, disallow other read |
chmod u=rw file | Set user permissions to read and write. |
Add up the values for the rights required.
| r | 4 |
| w | 2 |
| x | 1 |
For example: converting rwxr-x--- to octal:
7 = 4+2+1 = r + w + x
5 = 4+1 = r + x (not write)
0 = no rights
So rwxr-x--- is 750 in octal.
Octal values can be given to chmod, so
chmod 750 file
When run Unix executables can use the effective rights of a different user or group. This is shown by having an 's' rather than 'x'. For example:
bash> ls -l /bin/su
-rwsr-xr-x 1 root root 22904 Apr 27 2003 /bin/su
When su is run it runs with the same rights as the user
root.
Any program which is suid or sgid must be written very carefully to make sure that it can not be abused by malicious users to do things they shouldn't.
| Commands | |
|---|---|
chmod u+s | Set the suid bit |
chmod u-s | Clear the suid bit |
chmod g+s | Set the sgid bit |
chmod g-s | Clear the sgid bit |
Set gid on a directory means that all new files and directories created in that directory will have the same group as that directory.
When set gid is not set on a directory then the group used for new files and directories is the default group for that user.
Does anyone know what suid on a directory does?
Normally (without 't') any user who has write permission to a directory can delete any files in the directory regardless of who owns it, even if they can't read or write to the file.
With 't' set, only the owner of a file can delete it.
This is used on /tmp
bash> ls -ld /tmp
drwxrwxrwt 8 root root 4096 Nov 2 19:27 /tmp
| Commands | |
|---|---|
chmod +t directory | Set the sticky bit on a directory |
chmod -t directory | Remove the sticky bit from a directory |
The logical not of your umask is used as the default
permission for files or directories created by you.
A typical umask is 002, not(002) = 775 (in octal). 775 corresponds to rwxrwxr-x, or the owner and group can read, write, and execute, while others can only read or execute, but not run. Where the file isn't executable rw-rw-r-- will be used.
Most Linux distributions will configure a group for every user, eg my username is kim, and there is also a group kim, of which I am the only member. The default mask is 0002 so by default all files I create are group writable, but this isn't a problem as I'm the only person in the group.
If you have a group of people (eg staff) who you would like to be able to
write to a directory tree then change the base directory group to staff, and
chmod g+s. Assuming each user has a umask of 0002 then all
files and directories created will be writable by everyone in group.
| Commands | |
|---|---|
umask | display current umask |
umask 002 | set umask to 002 |
For more information about any of the commands or files mentioned earlier see the appropriate man page. Note that most commands are in section 1 of the manual, while section 5 details file formats.
| Commands | |
|---|---|
man 1 passwd | View the man page for the passwd(1) command. |
man 5 passwd | View the man page for the passwd(5) file. |
man -a passwd | View the all man pages for passwd. |
man chmod | View the man page for the chmod(1) command. |
This presentation is available from http://oldfield.wattle.id.au/luv/permissions.html