Linux File System Special permissions

Linux File System Special permissions

In addition to the common read (R), write (W), execute (x) permissions, there are 3 special permissions on the Linux system, namely Setuid, setgid, and stick bit

The security context of the process, provided that:

The process is owned by the owner (the process is running as the user's identity);

(1) Whether the user can start an executable program file as a process, depending on whether the user has Execute permission on the program file;

(2) After the program is started as a process, the owner of the process is the current user, the initiator of the process, the group to which the process belongs, and the base group for the initiator;

(3) The access rights of the process, depending on the owner's access rights:

(a) The owner of the process and the owner of the document, the application document is the master authority;

(b) The owner of the process, belonging to the group of documents, the application file is a group of permissions;

(c) Apply other rights;

Briefly describes Suid, Sgid, which starts a new shell process when the user starts to log on to the system. This new shell process (usually bash) runs with your user ID. Bash programs can access all of your files and

Directory. As a user, rely entirely on other programs to perform actions on behalf of the current user. Because the currently initiated program inherits the user identity, the current user cannot access any file system objects that are not allowed to be accessed by the current user.

Here's an example: the general user cannot directly modify the passwd file because the "write" flag has been closed for every user except "root":

[Email protected] ~]# ls-l/etc/passwd

-rw-r--r--. 1 root root 2528 September 1 12:48/etc/passwd

At this time there is a question, the current user how to change their password? The Linux permissions model has two dedicated bits, called "suid" and "Sgid". When a bit of "suid" is set for an executable program, it runs on behalf of the owner of the executables, not the person who initiates the program. To return to the/etc/passwd issue, review the passwd executable file:

[Email protected] ~]# ls-l/usr/bin/passwd

-rwsr-xr-x. 1 root root 27832 June 2014/usr/bin/passwd

Here a s takes the user right one x in the ternary group. This shows that for this special program, the SUID and executable bits are set. It is for this reason that when passwd is running, it executes (with full superuser access) on behalf of the root user, rather than running on behalf of the user running it. And because passwd runs as root user access, it is able to modify the/etc/passwd file without any problems.

Suid How to work, sgid work in the same way. It allows the program to inherit the group ownership of the program, rather than the current user's program ownership.

Settings for setuid (suid), Setgid (Sgid), and stick bit (sticky)

SUID: Any executable program file can be started as a process: depending on whether the initiator has EXECUTE permission on the program file, the owner is not the initiator, and the program file belongs to the owner, and this mechanism is suid;

Set:

chmod u+s FILE ...

chmod u-s FILE ...

Note: s: The owner of the original X permission; s: The owner of the original no X permission;

GUID: By default, when a user creates a file, its genus is the base group to which the user belongs, and once a directory is set to Sgid permissions, the user who has write permission on the directory to which the file is created in this directory belongs to the group belonging to the directory, not to the user's base group;

Set:

chmod g+s FILE ...

chmod g-s FILE ...

Sticky: For a multi-person writable directory, this permission is used to restrict each file that can only delete itself;

Set:

chmod o+t FILE ...

chmod o-t FILE ...

The following digital patterns help to understand:

Set sticky, suid, sgid bits:

Suidsgidsticky mode Digital

on7

onoff6

On off5

On off4

offon 3

Offonoff2

Offoffon1

offoff 0

Practice:

1, so that ordinary users can use/tmp/cat to view/etc/shadow files;

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/8F/wKiom1XmkTuijPGqAAWaBLtJMOY377.jpg "title=" 40.jpg "alt=" Wkiom1xmktuijpgqaawabltjmoy377.jpg "/>

2, create the directory/test/data, let a group of ordinary users have write permission to it, and all the files created by the group of directories belong to the group, in addition, each user can only delete their own files;

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/8F/wKiom1XmkhngLhVuAACEcBdXcOw835.jpg "style=" float: none; "title=" 41.jpg "alt=" Wkiom1xmkhnglhvuaacecbdxcow835.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/8C/wKioL1XmlDvjrvaVAAHu6dj3NQk310.jpg "style=" float: none; "title=" 41-1.jpg "alt=" Wkiol1xmldvjrvavaahu6dj3nqk310.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/8C/wKioL1XmlGLjf2sUAABx12vAiGA656.jpg "title=" 42.jpg "alt=" Wkiol1xmlgljf2suaabx12vaiga656.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/8C/wKioL1XmlJuDniW1AAG3M-Ga9jg947.jpg "title=" 43.jpg "alt=" Wkiol1xmljudniw1aag3m-ga9jg947.jpg "/>

Note: such as modify the file or directory attribute permissions, other terminal ordinary users are still accessing, to make the modified attribute permissions, etc., the normal user needs to log off again

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/8C/wKioL1Xml3iDDBRQAAXf0nNvtDk415.jpg "title=" 45.jpg "alt=" Wkiol1xml3iddbrqaaxf0nnvtdk415.jpg "/>

This article is from the "10,000-hour Law" blog, be sure to keep this source http://daisywei.blog.51cto.com/7837970/1690798

Linux File System Special permissions