Linux Special permissions (ii)

　　The role of RWX is described in the basic permissions above. But perhaps someone in the right blue bar to see an S symbol, this is a special permission.

Special permissions for files include:SUID,SGID, Sbit.

1. SUID, lending permission to the program owner

[Email protected]:/home$ ll/usr/bin/-RWS154256 March     /usr/bin/passwd*   #拥有SUID权限, the first group of RWX X is changed to S

　　passwd command to modify the user's password, according to the permissions can be informed that the same user group or other people can call the change command. However, the passwd command needs to modify the/etc/shadow file, which stores the password for the account.

[Email protected]:/home$ ll/etc/Shadow11517:/etc/ Shadow[email protected]:

As you can see, this file that was modified by passwd only allows the root user to modify the permissions. So here's the problem ~

　　Although other users can call the passwd command, but cannot modify the/etc/shadow this file Ah, then how to store the password?

This is the role of suid, you do not have the right to modify the/etc/shadow file? I (program owner) to you ah. That is, at this time, other users call the passwd command has temporarily obtained the root user's permission , then to modify the/etc/shadow is to use the root user's permission to modify.

• SUID permissions are valid only for binary programs
• Performer needs x permission
• Performer gets permission from the owner of the program
• Change permissions only in the execution of this program

In simple terms, this s permission will temporarily lend permission to someone else to use the permissions of the program owner, provided that someone else has the X permission for the program.

2. SGID, lending permissions to the user group

[Email protected]:/home$ lldrwxr4096: hang/  DRWXR-xr-x  24096: zncu/ drwxRWS  ---  24096: znha/

To put it simply, Sgid and suid one is to temporarily lend the permissions of the user group by lending the owner permission temporarily.

• Sgid is still valid for binary programs
• Program Performer needs x permission
• The performer temporarily obtains the permissions of the user group during execution

However, Sgid can also be used for directories or files, the example above is the use of directories.

So what does it do?

• When the user (hang) has r and X permissions on this directory (Znha), the user can enter this directory.
• The user's valid user group under this directory becomes the user group for that directory.
• If the user has W permissions for this directory, then the user group of the user-created file will be the user group for this directory.

[Email protected]:/home$ groups Hang #hang user in Znha user group, so have access to Znha directory Hang:hang Znha

Create a file in this directory and observe the user group where the file resides

[Email protected]:/home/znha$ touch test[email protected]:/home/znha$ ll1Znha    0:   #hang用户在具有SGID的目录里创建文件, the user group for this file is Znha (the user group where the directory resides)
[Email protected]:~$ cd hang/
[Email protected]:~/hang$ Touch Test # Create a file in another directory, the user group of the file is hang (user's main user group)　　　
[Email protected]:~/hang$ ll
-rw-rw-r--1 Hang  hang 0 November 20:56 test

You can see that the user group of the file asks Znha, not hang. This feature can enables multiple users in the same user group to have a common directory, and all users of that user group have the same rights to manipulate files when the file is created.

3. Sbit, valid for directory

• When a user has W, x permissions for this directory, the Write permission is
• 　When a user creates a file in this directory, only himself and Root have the right to delete (and other W related actions) that file
• User does not allow files to be manipulated by other users

DRWXRWXRWT   root root  4096: tmp/ # with Sbit permission, the last letter T is indicated.

　Settings for special permissions:

Suid:4

Sgid:2

Sbit:1

chmod 4777 Test , add suid permissions.

Http://www.cnblogs.com/yuhanghzsd/p/6107362.html

Linux Special permissions (ii)