Detailed explanation of CentOS Permissions

Detailed explanation of CentOS Permissions

1. Linux File Attribute structure format (take the root user's home directory as an example)

[Root @ localhost ~] # Ls-l # command for displaying file names and Related Properties

Total 120

Drwxr-xr-x 2 root 4096 Dec 10 07:57:04

Drwxr-xr-x 2 root 4096 Dec 10 07:57 10

Drwxr-xr-x 2 root 4096 Dec 10 07:57 2015

-Rw -------. 1 root 2454 Dec 6 anaconda-ks.cfg

Drwxr-xr-x 2 root 4096 Dec 10 07:57 CST

Drwxr-xr-x 2 root 4096 Dec 10 07:57 Dec

Drwxr-xr-x 2 root 4096 Dec 6 22:50 Desktop

Drwxr-xr-x 2 root 4096 Dec 6 Documents

Drwxr-xr-x 2 root 4096 Dec 6 Downloads

-Rw-r --. 1 root 45098 Dec 6 install. log

-Rw-r --. 1 root 9963 Dec 6 install. log. syslog

Drwxr-xr-x 2 root 4096 Dec 6 22:50 Music

Drwxr-xr-x 2 root 4096 Dec 6 22:50 Pictures

Drwxr-xr-x 2 root 4096 Dec 6 22:50 Public

Drwxr-xr-x 2 root 4096 Dec 6 22:50 Templates

Drwxr-xr-x 2 root 4096 Dec 6 Videos

[Display format ]:

Total:

Type and number of permission connections owner user group file size modification date file name

1. total: total disk space used by the listed content and the value (kbytes)

Indicates the directory size. Incomplete explanation: the sum of the fifth field of all files and directories in the directory list

Note: Not necessarily equal to the sum. This number is an integer multiple of the blocksize used, and is related to the number of blocks used.

2. Type and permission (permission): four-digit representation

(1) file type:

-: Regular files; that is, f and file;

D: directory, directory file;

B: block device. block device files. Random access, such as hard disks and floppy disks, can be performed in units of block...

C: character device, a character device file, supporting linear access in the unit of "character"

Serial Port receiving device, one-time reading, such as the keyboard, mouse..., expressed by the master, secondary device number

Major number: the master device number, used to identify the device type, and then determine the driver to be loaded

Minor number: the second device number, used to identify different devices of the same type;

L: symbolic link, a symbolic link file. It is similar to a shortcut in Windows.

P: pipe, named pipe; solves the error caused by multiple programs accessing a file, FIFO (first-in-first-out)

S: socket, socket file; usually used for data connection on the network,

(2) Permission Combination Mechanism: (8bites binary)

The second ten characters: each of the three is a group, which is a combination of three parameters: 'rwx'

Rwxrwxrwx is fixed at any position. It is null if no position exists. It is indicated by the '-' symbol.

R: readable, read; w: writable, write; x: excutable, run

R = 4 W-2 x = 1-= 0

[File directory]

File owner: user to which the file belongs

User Group to which the file belongs: User Group with the file owner

Others: other persons not in this user group

3. Connections: Number of hard connections, indicating how many file names are connected to this node (I-node)

(1) hard link: use different names (paths) to point to the same inode connection method

Same inode number, greater than one

1) You can only create a file, but not a directory.

2) hard links cannot be created across file systems, but can be stored in different directories.

3) increase the number of file connections during creation, that is, the second field of ls-l.

4) cp will pay for the new inode and block. The hard link inode is different, but the block is the same.

(2) soft connection: similar to the shortcut in Widows, the directory is stored as another path.

1) number of characters in the path

2) It can be used for directories without increasing the number of file connections

3) Cross-File System

4) The created soft connection has 777 permissions, but the actual access permission is related to the permissions of the file to be linked.

4. Owner: account to which the file or directory belongs

5. affiliated group: the basic group of the account to which the file or directory belongs

6. Capacity: The default unit is B.

General file size:

Directory file size: the size of the Directory, which is the size of several blocks.

Connection type file size: the size of the number of characters in the connection file name

7. modification date: the file creation date or the most recent modification date

Display the complete time format: ls-l -- full-time

Three timestamps on Linux:

Access time: access time, the time recorded after the file is viewed

Modify time: content data time, file content data changes, and some log files increase

Change time: status time. For example, if the permission is explicitly changed, status time

8. File Name: File Name

If a "." is added before the file name, the file is hidden.

Ii. File directory access control

1. Application Model for file access permissions of Linux Processes

Process security context:

Whether the process owner is the same as the file owner; if the process owner is the same, the application owner permission;

Otherwise, check whether the owner of the process belongs to the file group. If yes, apply the Group permission;

Otherwise, only other permissions can be applied;

2. Different definitions of permissions on files and directories

(1) Meaning of the file

R: obtains the data of a file. You can use a cat command to view the file content.

W: The data of a file that can be modified. The file can be edited or deleted.

X: This file can be run as a process. It can be submitted to the kernel as a command at a command prompt.

(2) meanings of directories

R: You can use the ls command to obtain the list of all files under it;

W: You can modify the file list in this directory. That is, you can create or delete files;

X: You can run cd in this directory and use ls-l to obtain detailed attribute information of all files;

3. permission management commands

1. chmod: Change the file directory permission

User Type: u: Owner g: Group o: Other a: All

(1) chmod [OPTION]... MODE [, MODE]... FILE...

1) Authorization representation: directly operates the class-one user's ownership limit rwx.

Expressed by equal sign: one or more bits in [u | g | o | a] = rwx

2) Authorization representation: directly operates a permission bit r, w, x of A Class of users.

[U | g | o | a] [+ |-] rwx

(2) chmod [OPTION]... OCTAL-mode file...

Add permissions to the file directory by using three digits, indicating the permissions of the owner, owner group, and others.

The representation of numbers is the same as that of the 8bites binary representation permission Combination Mechanism.

R = 4 W-2 x = 1-= 0 three-digit addition

(3) chmod [OPTION]... -- reference = rfile file... Authorize an object by referring to its permissions.

-R, -- recursive: recursive Modification

Note: normal users can only modify the permissions of files whose owner is their own. root users can change the permissions of all users.

2. chown: Change the owner of the file directory or change the group

(1) chown [OPTION]... [OWNER] [: [GROUP] FILE...

1) only change the user owner

2) Owner: Owner group, which can be changed at the same time

The owner. Owner group can also perform the preceding operations, but be careful that there is a. System Identification error in the file name.

(2) chown [OPTION]... -- reference = rfile file... Authorize an object by referring to its permissions.

-R: recursive Modification

3. chgrp: Change the group to which the file directory belongs.

(1) chgrp [OPTION]... group file... Change Group

(2) chgrp [OPTION]... -- reference = rfile file...

Authorize an object by referring to its permissions.

4. install: copy and set the property permission copy files and set attributes

(1) single-source replication:

Install [OPTION]... [-T] SOURCE DEST

(2) multi-source replication:

Install [OPTION]... SOURCE... DIRECTORY

Install [OPTION]...-t directory source...

(3) create a directory:

Install [OPTION]...-d DIRECTORY...

(4) OPTIONS:

-M, -- mode = MODE: sets the target file permission. The default value is 755;

-O, -- owner = OWNER: Set the owner of the target file;

-G, -- group = GROUP: set the target file group;

5. umask: File Permission reverse mask, mask code

(1) umask: view the current umask

The default value is 0022, which indicates special permissions, owner permissions, all group permissions, and others' permissions.

Change the default location:/etc/login. defs

(2) umask operation on the file directory

1) file: 666-umask. The file cannot have the execution permission by default.

If you have execution permission in the result, you need to add 1 to the result.

2) Directory: 777-umask

Iv. Special Permissions

1. SUID: when running a program, the owner of the corresponding process is the owner of the program file.

Chmod u + s FILE adds SUID permission

Chmod u + s FILE Delete SUID permission

If the FILE itself has executable permissions, SUID is displayed as a; otherwise, the value is S.

2. SGID: when a program is running, the group of the corresponding process is the group of the program file, rather than the group of the initiator.

Chmod g + s FILE

Chmod g-s FILE

3. sticky: In a public directory, each user can create and delete files, but cannot delete others

Note: This permission only applies to Directory

Chmod o + t DIR

Chmod o-t DIR

4. SUID and SGID can only operate on files, and sticky can only operate on directories

SUID = w SGID = 2 sticky = 1

V. Consideration and verification of permission issues

Thinking: Can users modify the content of a directory if they have write permission on the directory but have no write permission on the files under the directory? Can I delete this file? Can I use vim to modify

1. When the owner and group are the same: both are gentoo, use gento

1) switch to gentoo, and create the test directory testand test file test.txt under/tmp.

[Root @ localhost ~] # Su-gentoo

[Gentoo @ localhost ~] $ Cd/tmp

[Gentoo @ localhost tmp] $ mkdir test

[Gentoo @ localhost tmp] $ touch test/test.txt

2. Change the permission. Make sure that the prefix directory testhas the write permission. The file test.txt does not have the write permission.

[Gentoo @ localhost tmp] $ ll | grep test

Drwxrwxr-x 2 gentoo 4096 Dec 12 test

[Gentoo @ localhost tmp] $ cd test

[Gentoo @ localhost test] $ chmod 500 test.txt

[Gentoo @ localhost test] $ ll

Total 0

-R-x ------ 1 gentoo 0 Dec 12 10:19 test.txt

3) Write Data Using echo write command

[Gentoo @ localhost test] $ echo 'hello'> test.txt

-Bash: test.txt: Permission denied

4) try to write data using vim

[Gentoo @ localhost test] $ vim test.txt

-- INSERT -- W10: Warning: Changing a readonly file

Exit force save

E45: 'readonly' option is set (add! To override)

The result can be written. The file owner, owner, and permissions have not changed.

2. When the owner and group are different: The file owner is gentoo, and the group is slckware, which is operated by gentoo users.

1) Create the test file test1 under/tmp/test in the same operation as above. Change the permission and group to slackware.

2) Write Data Using echo write command

[Gentoo @ localhost test] $ echo 'hello'> test1

-Bash: test1: Permission denied

3) try to write data using vim

[Gentoo @ localhost test] $ vim test.txt

-- INSERT -- W10: Warning: Changing a readonly file4

Force exit and save

E45: 'readonly' option is set (add! To override)

The result can be written. The file owner, owner, and permissions have not changed.

3. When the owner and group are different: The file owner is gentoo, and the group is slckware, which is operated by the slckware user.

[Root @ localhost test] # chmod g + r test1

[Root @ localhost test] # su-slackware

[Slackware @ localhost ~] $ Cd/tmp/test

[Slackware @ localhost test] $ ll

Total 4

-R-xr ----- 1 gentoo slackware 7 Dec 12 :11 test1

[Slackware @ localhost test] $ vim test1

[Slackware @ localhost test] $ ll

Total 4

-R-xr ----- 1 slackware 21 Dec 12 :17 test1

Conclusion:

1. Case 1 and Case 2 share the same conclusion: neither of them can write the modified file content with echo, but the result can be written. The file owner, owner group, and permission have not changed.

2. Case 3: different users operate other user files in the group without the write permission, and echo cannot write

However, vim can be forcibly written, but the file is not the original file, overwrite, and the owner changes.

As a common user, slackware does not have the chown permission and may re-write the overwriting File For vim's memory space.

At this time, the File Permission has not changed, and the owner has changed