Linux File Special permissions

Special permissions on the Linux file system

Security context for the process:

Prerequisite: The process is owned by the owner (the process is running as the user's identity);

(1) Whether the user can start an executable program file as a process, depending on whether the user has Execute permission on the program file;

(2) After the program is started as a process, the owner of the process is the current user, the initiator of the process, the group to which the process belongs, and the base group for the initiator;

(3) The access rights of the process, depending on the owner's access rights:

(a) The owner of the process and the owner of the document, the application document is the master authority;

(b) The owner of the process, belonging to the group of documents, the application file is a group of permissions;

(c) Apply other rights;

SUID:

(1) Any executable program file can be started as a process: depending on whether the initiator has EXECUTE permission on the program file;

(2) After initiating as a process, its owner is not the initiator, and the program file is the owner of its own, the mechanism is suid;

Permission settings:

chmod u+s FILE ...

chmod u-s FILE ...

Note:

S: The owner of the original x permission;

S: The original owner has no x permission;

SGID:

By default, when a user creates a file, the group is the base group to which the user belongs;

Once a directory has been set with Sgid permissions, the user who has write permission to this directory has the same group as the directory, not the user's base group, to which the files created in this directory belong.

Permission settings:

chmod g+s FILE ...

chmod g-s FILE ...

Sticky:

For a multi-person writable directory, this permission is used to restrict each file that can only delete itself;

Permission settings

chmod o+t FILE ...

chmod o-t FILE ...

SUID, SGID, STICKY

SUID is 4

Sgid is 2

Sticky is 1

It's exactly the same as r,w,x.

chmod 4777 FILE

Detailed explanation: Add suid to file files and other users of the main group have read and write Execute permission

chmod 3755 DIR

Detailed explanation: The dir directory was added sgid and sticky master has read and write execution, belong to the group and other users have the reading and execution rights

Chattr and Lsattr

chattr: Changing file properties

Common options:

+ On the basis of the original parameters, increase the parameters

-Reduction of parameters based on the original parameters

= Directly set to this parameter

I: Settings file can not be renamed, deleted, set link relationship. You cannot add and modify content ( This also takes effect for the root user )

A: Only allow files to be appended and cannot be deleted. More for server log security ( This is also in effect for root users )

Lsattr: Viewing file properties

Actual combat

1. Allow ordinary users to use/tmp/cat to view/etc/shadow files

Answer:

1. Cp/bin/cat/tmp/cat

2. chmod U+s/tmp/cat

3. Su-hadoop

4. /tmp/cat/etc/shadow

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/72/A9/wKioL1XrDAeh5WY6AAQLVugts9c143.jpg "title=" Ts1.png "alt=" Wkiol1xrdaeh5wy6aaqlvugts9c143.jpg "/>

2. Create a directory/test/data, let a group of ordinary users have write permissions to it, and all the files created by the group is the directory belongs to the group, in addition, each user can only delete their own files;

Answer:

1. Mkdir-p/test/data

2. Setfacl-m G:hadoop:rwx/test/data

3. chmod G+s,o+t/test/data

This article is from the "Wind Rhyme" blog, please be sure to keep this source http://chinalx1.blog.51cto.com/2334265/1691672

Linux File Special permissions