Linux User Rights Management

In Linux, the allocation and management of permissions is a very important thing. This is important for the management of files in the system. How to assign permissions is the key.

Permissions are divided into two right-of-use (MODE) and ownership (OWNERSHIP)

First I look at the composition of mode:

R: Readable

W: Writable

X:executable Executable

For the directory:

You can use the LS command to view the directory when you have R permissions

If you have W permission, you can modify the file name or file list in this directory to delete the file

With x permission, you can use the Ls-l command to get the details of the files in it (this is the basic permission, nothing is done at all)

For the file:

You can view or get data stored in a file when you have R permissions

When you have W permission, you can modify the data stored in the file (if you want to delete the file, you have the W permission to the directory where the file resides)

This file can be run as a process when you have X permissions

Here is an example of a specific analysis:

-rw-r--r--: Three privilege bits-owner, group, other user

-: Delegate is file (D-Word represents directory )

rw-: Master Permission

r--: Group Permissions

r--: Other user rights (do not give permission to write)

When setting permissions for a directory or file, in addition to rwx, it can be represented by the following method, which corresponds to the following:

---000 0

--x 001 1

-w-010 2

-WX 011 3

r--100 4

R-x 101 5

RW-110 6

RWX 111 7

For example, if you want to set RWX permissions, you can write 777

Note: Only the owner of a file can modify the file's use (except root)

Commands to modify or set permissions for a directory file are: chmod, Chown, CHGRP,

chmod command:

Usage: Chmod-change file mode bits

chmod [OPTION] ... Mode[,mode] ... FILE ...

MODE: Symbolic Permission Identification method

which

U,g,o,a represents ownership

+,-,= Identity Authorization method

R,W,X indicates the specific permission content

For a few examples:

chmod u+r,g-w,0=x File

chmod ug+r File

chmod +w file defaults to add only W permissions for the owner

chmod +x file adds x permission to all users by default

Note: File execution permissions are a very important security identity for Linux file systems.

chmod [OPTION] ... Octal-mode FILE ...

If you use octal digital notation, you must give the full permission bit each time

If the given permission bit is incomplete, the file system will be automatically replenished (left 0).

chmod [OPTION] ...--reference=rfile FILE ...

chmod--reference=a B (both A/b file in the current directory)

-R (Recursive modification): Uniformly set all files in the target directory and subdirectories and subdirectories to the specified permission ID

Chown command:

Chown: Both the master and the genus can be modified

Format: chown [OPTION] ... [OWNER] [: [GROUP]] FILE ...

Chown OWNER FILE

Chown:group FILE

Chown Owner:file

Chown Owner:group FILE

-R: Uniformly set all files in the target directory and subdirectories and subdirectories to the specified permission ID

chown [OPTION] ...--reference=rfile FILE ...

Note: Only the root user can complete the modification of the owership operation

CHGRP command:

CHGRP (less used): You can only modify the properties of a file

Format: chgrp [OPTION] ... GROUP FILE ...

CHGRP [OPTION] ...--reference=rfile FILE ...

Besides, the install command is also relevant.

Install Command: Installation: Copying files,

-o:set ownership (Super-user only)

-g:set group ownership, instead of process ' current group (super-user only)

Note: The install command cannot copy the directory, and if it is a directory, the install copies all of the non-directory files to the target location in turn.

OWNERSHIP: Ownership of resources

Master: A specific user who controls resources owner, U

Group: Some specific users who control resources, G

Other users: Those who have not mastered the resources other, O

All users: A

Special permissions: Suid,sgid,sticky

It is indicated as follows:

---000 0

--T 001 1

-S-002 2

-ST 003 3

s--004 4

S-T 005 5

ss-006 6

SST 007 7

We know that, by default in Linux, a user initiates a process whose owner is the initiator of the process,

But the situation is different when the file has suid permissions. (Note: SUID is only valid for files)

When a user initiates execution of a process, the program file, if it has suid permissions, is the owner of the program's file, not its initiator.

Usage format: chmod u+|-s FILE ....

Same Sgid permissions, (Note: Sgid only valid for directory)

If a directory has write permissions for some users and Sgid is set, then all users of this directory who have write permission to create directories or files in that directory, the group of new files are no longer the base group to create the user, but inherit the genus group of the directory.

STICKY (sticky): Sticky bit

If more than one user has write permissions in a directory, these users also have write permissions.

Special properties for files: Related commands lsattr, chattr

Lsattr (view)

lsattr [-RVADV] [files ...]

Chattr (modified) (A and I main)

Chattr-change file attributes on a Linux file system

chattr [-RVF] [-v version] [mode] files ...

Mode: Use +-= and so on to set

The most central setting of the entire chattr is the mode section

[Aabbccddijssttu] are required properties

A (Common): Set this property of the file, its contents cannot be changed or deleted, can only be appended to the file to write data, most of the server log class files are set to this property

A: File access timestamp, Io bottleneck, when a file with the ' a ' attribute set was accessed, its atime record was not modified. This avoids a certain amount of disk I/O for laptop systems.

C: Set whether the file is automatically compressed and stored

C (less used): Sets whether the file opens the copy on write property

D: Set file in use Dump

D (preferably not set): Sets the asynchronous write operation of the file in the file system

I (important): Settings file cannot be deleted, modified, set link relationship

S: Set the file's privacy Delete.

U: Contrary to the S property,

-r: Set the specified directory recursively

Example: Chattr +i FILE

Assigning additional permissions to a file: Facl (Centos7 only matured after 5)

Commands related to Facl:

Getfacl:

Getfacl-get File access Control lists

Getfacl [-ACEESRLPTPNDVH] File ...

Getfacl [-ACEESRLPTPNDVH]-

Setfacl:

Setfacl-set File access Control lists

Setfacl [-BKNDRLPVH] [{-m|-x} Acl_spec] [{-m|-x} Acl_file] File ...

Setfacl--restore=file

To give the user additional privileges:

Setfacl-m U:username:mode File ...

To assign additional permissions to a group:

Setfacl-m G:groupname:mode File ...

Revoke additional permissions for the user:

Setfacl-x u:username File ...

To revoke additional permissions for a group:

Setfacl-x g:groupname File ...

This article is from the "Clean yourself into" blog, please be sure to keep this source http://liangqunzhi.blog.51cto.com/10674929/1914175

Linux User Rights Management