Go Properties of Linux files and directories

Original: https://www.cnblogs.com/kzloser/articles/2673790.html

Https://www.cnblogs.com/danh/archive/2011/01/11/1932975.html

The content originates from: Brother Bird's Linux private dish

The links are as follows:

File permissions and directory configuration for Linux

Linux disk and File system management

Linux File and directory management

Directory

Linux file properties [file attribute Resolution (suid/sgid/sbit)] [Hide Properties]
Modify file properties [Chgrp][chown][chmod][umask]
Permissions for directories and files [the meaning of permissions to a file] [the meaning of permissions to a directory]
Linux file types and extensions [file type][linux file extension][linux file length limit]

Linux file properties

[File attribute Resolution (Suid/sgid/sbit)] [Hide Properties]

File attribute resolution

After logging into Linux as root, you can see the following when you enter "Ls-al" on the command line:

[Email protected] ~]# Ls-al
Total 156
Drwxr-x---4 root root 4096 Sep 8 14:06.
Drwxr-xr-x root root 4096 Sep 8 14:21.
-RW-------1 root root 1474 Sep 4 18:27 anaconda-ks.cfg
-RW-------1 root root 199 Sep 8 17:14. bash_history
-rw-r--r--1 root root 6. bash_logout
-rw-r--r--1 root root 191 Jan 6. Bash_profile
-rw-r--r--1 root root 176 Jan 6. BASHRC
-rw-r--r--1 root root 6. CSHRC
drwx------3 root root 4096 Sep 5 10:37. gconf <= Sample Description Office
drwx------2 root root 4096 Sep 5 14:09. gconfd
-rw-r--r--1 root root 42304 Sep 4 18:26 install.log <= Sample Description Office
-rw-r--r--1 root root 5661 Sep 4 18:25 Install.log.syslog
[1] [2] [3] [4] [5] [6] [7]
Permissions Link [owner] Group [File Capacity] [Date Modified] [File name]

Take the example of Install.log as a description:

First column: Type and permissions (permission)

Emoticons

• The first character represents the type of the file (such as a directory, file, or linked file, and so on):
1. When [d] is the directory, for example, the row with the table file named ". GConf";
2. When [-] is the file, for example, the previous table is named "Install.log" the line;
3. If [l] is indicated as a link file (link file);
4. If [b] is indicated as the device file inside the storage interface device (can be random access device);
5. If [C] is indicated as a serial port device in the appliance file, such as a keyboard, mouse (disposable reading device)
• A combination of three parameters in the next character, grouped by three, and all "rwx"
  < [R] stands for readable (read), [W] for writable (write), [x] for executable (execute) Note that the location of these three permissions does not change, and if there is no permission, a minus sign [-] will appear >
1. The first group is "permissions of the file owner", the file "Install.log" as an example, the owner of the file can read and write, but not executable;
2. The second group is "permission of the same group";
3. The third group is "permissions for other non-native groups".
• Special Permissions suid, SGID, Sbit:[Email protected] ~]# ls-ld/tmp; Ls-l/usr/bin/passwd/usr/bin/locate/var/lib/mlocate/mlocate.db
  DRWXRWXRWT 7 root root 4096 Sep 18:23/tmp
  -rwsr-xr-x 1 root root 22984 Jan 7 2007/usr/bin/passwd
  -rwx--s--x 1 root slocate 23856 Mar 2007/usr/bin/locate
  -rw-r-----1 root slocate 3175776 Sep 04:02/var/lib/mlocate/mlocate.db

  Set UID:
  When s this flag appears in the file owner's x permission, as above/usr/bin/passwd this file's permission state, at this time is called the Set UID, referred to as SUID special permission. Basically suid has this limitation and function:

  • SUID permissions are valid only for binary programs (binary program) (cannot be used on shell script)
  • The runner is required to have the operational privileges of X for the program
  • This permission is valid only in the course of running the program (RUN-TIME)
  • The runner will have the permissions of the program owner (owner)

  Take the passwd file as an example:

  Vbird for/USR/BIN/PASSWD This program is the X-permission, indicating Vbird can run passwd;
  The owner of the passwd is the root account; Vbird runs the passwd, it "temporarily" gets root;
  /etc/shadow can be modified by the passwd run by Vbird.
  But if Vbird uses cat to read/etc/shadow, can he read it? Because cat does not have SUID permissions, Vbird cannot read/etc/shadow when it runs "Cat/etc/shadow". We use one to illustrate the following:
  Figure 4.4.1, SUID program run process

  SGID:
  Unlike SUID, SGID can be configured for files or directories!

  If it is for the file, SGID functions as follows:

  • SGID is useful for binary programs, and the program runner is required to have X permission for the program
  • The runtime will get permission from the program group during the run

  If you are targeting a directory, SGID functions as follows:

  • Users can enter this directory if they have r and X permissions on this directory;
  • The user's active group (effective group) in this directory will become a group of that directory;

  Sticky Bit:
  This Sticky Bit, Sbit is currently only valid for directory functions is:

  • When the user has W, x permission, that is, the Write permission for this directory;
  • When a user creates a file or directory under that directory, only himself and Root have the right to delete the file

  In other words: When a user in a directory is a group or someone else's identity, and has the permission of the directory W, which means that "a user of the directory created by anyone in the directory or file can be" delete/rename/move "and so on. "However, if you add the a directory to the Sbit permission item, you can only delete/rename/move the files or directories you create, and you cannot delete others ' files.

  [Email protected] tmp]# chmod 7666 test; Ls-l test <== has empty Suid/sgid permissions
  -RWSRWSRWT 1 root root 0 Sep 03:06 test

  The user, group, and others do not have X, which is a running flag (because 666), so this S, T means "empty".

Column two: How many files are linked to this node (I-node)

Record how many different filenames are linked to the same i-node (each file will log his permissions and attributes to the i-node of the filesystem, but the directory tree we use is recorded using a file name, so each file name is linked to a i-node)

Third column: Owner of the file (or directory)

Column four: The group to which the file belongs

Under the Linux system an account will be attached to one or more groups (assuming that a file belongs to a group of ProjectA, and the file's permissions (-rwxrwx---), then Class1, Class2, class3 three for the file are readable, writable, The permissions that you can perform (see Group permissions). However, if the other account is not part of projecta, there is no permission for this file.

Column five: The size of the file (default unit is bytes)

Column Six: Document file date or last modified date

The contents of this column are date (month/day) and time respectively. If the file has been modified for too long now, then the time section will only show the year. As shown below:

[Email protected] ~]# ls-l/etc/termcap/root/install.log

-rw-r--r--1 root root 807103 Jan 7 2007/etc/termcap
-rw-r--r--1 root root 42304 Sep 4 18:26/root/install.log
# as shown above,/etc/termcap is 2007 years of modified documents, so far from the present;
# As for the Install.log is established this year (2009), so it shows the full time.

Seventh column: The full path of the file and its filename

This field is the file name. More Special: If the file name is preceded by one more. ", the file is a" hidden document ", which is the hidden file in the. gconf line in the previous table. You can display hidden documents using "LS" and "ls-a"

Hide Properties

In addition to basic R, W, x permissions, we can also configure other system-hidden properties under Linux's Ext2/ext3 file system. But first of all, the bottom chattr command can only take effect on the Ext2/ext3 file system, and other file systems may not be able to support this command. Let's talk about how to configure and check these hidden properties!

Chattr (Profile Hide property)

[[email protected] ~]# chattr [+-=][asacdistu] file or directory name
Options and Parameters:
+: Add a special parameter, other existing parameters will not move.
-: Remove a particular parameter, otherwise the original parameter does not move.
=: Configuration must be, and only subsequent parameters

A: When you configure a This property, if you have access to this file (or directory), his access time atime will not be modified, to avoid the slow I/O machine over-access disk. This is helpful for slower computers
S: General files are non-synchronous write disks ( Principle please refer to the fifth Chapter Sync instructions), if you add S this attribute, when you make any file modification, the change will be "synchronously" written to the disk.
A: After you configure a, the file will only add data, not delete, and cannot modify the data, only root can configure this property.  
C: After this property is configured, it will automatically "compress" the file, which will be automatically decompressed when it is read, but when it is stored , it will be compressed and then stored (it seems pretty useful for large files!).
D: When the dump program is run, configuring the D property will allow the file (or directory) to not be backed up by dump
I: This I can be very powerful! He can make a file "can not be deleted, renamed, CONFIGURED links can not write or add data!" "It's a great help for system security!" Only root can configure this property
S: When the file is configured with the S property, if the file is deleted, he will be completely removed from the hard disk space, so if deleted by mistake, can not be saved back Oh!
U: In contrast to S, when using U to configure a file, if the file is deleted, then the data content actually exists in the disk, you can use to rescue the file Oh!
Note: Property configuration is common for configuration values of a and I, and many configuration values must be root to configure

Example: Please try to create a file under/tmp, and add the parameters of I, try to delete the look.
[Email protected] ~]# cd/tmp
[[email protected] tmp]# Touch attrtest <== Create an empty file
[[email protected] tmp]# chattr +i attrtest <== giving I properties
[[Email protected] tmp]# RM attrtest <== try to remove see
Rm:remove write-protected Regular empty file ' Attrtest '? Y
Rm:cannot remove ' attrtest ': Operation not permitted <== operation not permitted
# Did you see it? Whirring Even Root has no way to delete this file! Quickly release the configuration!

Example: Please cancel the I property of the file!
[Email protected] tmp]# chattr-i attrtest

This command is important, especially on the data security of the system! Because these properties are hidden properties, you need to lsattr to see the property! Among them, the person thinks the most important belongs to +i and +a this attribute. +i can make a file impossible to change, it is very important for people who need strong system security! There are quite a few properties in it that need root to configure!

In addition, if it is log file such a login, it is more necessary to +a this can be added, but cannot modify the old data and deleted parameters! How? It's great! In the future when it comes to the cognition of the login file (Chapter 19), let's talk about how to configure him!

Lsattr (show file hidden properties)

[[email protected] ~]# lsattr [-adr] File or directory

Options and Parameters:
-A: Show the properties of the hidden files;
-D: If a directory is followed, only the properties of the directory itself, not the file name within the directory;
-R: The data along with subdirectories are listed as well!

[Email protected] tmp]# chattr +aij attrtest
[Email protected] tmp]# lsattr attrtest
----IA---J---attrtest

With the chattr configuration, you can use lsattr to look up hidden properties. However, these two commands must be used with special care, otherwise it will cause great distress. For example: One day you are in a good mood, suddenly will/etc/shadow this important password record file to him configured to have an I attribute, Then after a few days, you suddenly want to add users, but has been unable to add! Don't doubt, go ahead and take out the attributes of I!

Modify file properties

[CHGRP] [Chown] [Chmod] [Umask]

CHGRP: Change the file belongs to group [[email protected] ~]# CHGRP [-r] Dirname/filename ...

Options and Parameters:
-R: Continuous change of recursion (recursive), that is, all files and directories in the secondary directory
are updated to the meaning of this group. Often used in the case of changing all files in a directory.

Example:
[Email protected] ~]# CHGRP users Install.log
[Email protected] ~]# ls-l
-rw-r--r--1 root users 68495 June 08:53 Install.log
[Email protected] ~]# CHGRP testing Install.log
Chgrp:invalid group name ' testing ' <== error message ~ Can't find this group name ~

Chown: Change file owner [[email protected] ~]# Chown [-r] Account name file or directory
[[email protected] ~]# Chown [-r] Account name: Group name file or directory
Options and Parameters:
-R: Continuous change of recursion (recursive), i.e. all files in the sub-directory are changed

Example: Change the owner of the Install.log to bin this account:
[Email protected] ~]# Chown bin Install.log
[Email protected] ~]# ls-l
-rw-r--r--1 bin users 68495 June 08:53 Install.log

Example: Change the owner and group of Install.log back to root:
[Email protected] ~]# chown root:root Install.log
[Email protected] ~]# ls-l
-rw-r--r--1 root root 68495 June 08:53 Install.log

When you copy a file to someone other than you, because the copy behavior (CP) replicates the performer's properties and permissions, then someone else will not be able to use the file you copied to him, so you have to change the owner and group of the file.

chmod: Features that change file permissions, SUID, SGID, Sbit, and so on

• Number types Change file permissions

  The score table for each permission is as follows:

  1. Suid:4
  2. Sgid:2
  3. Sbit:1
  4. R:4
  5. W:2
  6. X:1

  Each identity special permission (suid/sgid/sbit) and (Owner/group/others) the respective three permission (R/W/X) scores are required to accumulate

  For example, when the permission is: [-rwxrwx---] the score is:
  Owner = rwx = 4+2+1 = 7
  Group = RWX = 4+2+1 = 7
  others=---= 0+0+0 = 0

  For example, when the permission is: [-RWsr-Sr-x] The score is:

  Special permissions = Suid&&sgid = 4+2 = 6
  Owner = RWS = 4+2+1 = 7
  Group = R-s = 4+1 = 5
  others= r-x = 1 = 5

  So wait a minute. When we set the permission change, the permission number of the file is 770! The syntax for the Change permission directive chmod is this:

  [[email protected] ~]# chmod [-r] xyzw file or directory
  
  Options and Parameters:
  X: Optional, represents a special permission, that is Suid/sgid/sbit
  YZW: is the permission attribute of the number type just mentioned, which adds the value of the RWX attribute
  -R: Continuous change of recursion (recursive), i.e. all files in the secondary directory will be changed
  
  [Email protected] ~]# cd/tmp
  [[email protected] tmp]# Touch test <== Create a test empty file
  [Email protected] tmp]# chmod 4755 test; Ls-l test <== joins permissions with SUID
  -rwsr-xr-x 1 root root 0 Sep 03:06 test
  [Email protected] tmp]# chmod 6755 test; Ls-l test <== joins permissions with Suid/sgid
  -rwsr-sr-x 1 root root 0 Sep 03:06 test
  [Email protected] tmp]# chmod 1755 test; Ls-l Test <== added sbit features!
  -rwxr-xr-t 1 root root 0 Sep 03:06 test
  [Email protected] tmp]# chmod 7666 test; Ls-l test <== has empty Suid/sgid permissions
  -RWSRWSRWT 1 root root 0 Sep 03:06 test
• Symbol Type Change file permissions

  There is also a way to change the permissions yo! From the previous introduction, we can find that basically nine permissions are (1) User (2) group (3) Others three kinds of identities! Then we can represent three kinds of identities by u, G, O! In addition, a represents all and all identity! Then the permission to read and write can be written as R, W, x! SUID is U+s, and SGID is G+s, Sbit is o+t! That is, you can see it in the following way:

  chmod

  U G O A

  + (Join) -(remove) = (set)

  R W X

  File or directory

  Let's do it! If we want to "set" the permissions of a file as "-rwxr-xr-x", it is basically:

  • User (U): Has readable, writable, executable permissions;
  • Group and others (G/O): Have read and Execute permissions.

  So it is:

  [Email protected] ~]# chmod u=rwx,go=rx. BASHRC
  # Watch out! The U=rwx,go=rx is connected, and there is no space in the middle!
  [Email protected] ~]# ls-al. BASHRC
  -rwxr-xr-x 1 root root 395 Jul 4 11:45. BASHRC
  [Email protected] tmp]# chmod g+s,o+t test; Ls-l Test
  -rws--s--t 1 root root 0 23:47 test

File default permissions: Umask

Umask is specifying "the current user's permission defaults when creating a file or directory"

[Email protected] ~]# umask
0022 <== with general permissions is the back three numbers!
[Email protected] ~]# umask-s
U=rwx,g=rx,o=rx
[Email protected] ~]# umask 002

Umask's score refers to the permission that the default value needs to be lost! "Because R, W, X are 4, 2, 1, respectively.

On the properties of the default permissions, the directory is not the same as the file. The X-permission is very important to the directory! However, the creation of general files should not have permission to run, the default is as follows:

• If the user is created as "file" then the default "no operational (x) permissions", that is, only the RW two items, which is the maximum of 666 points
• If the user is created as a "directory", then it is related to whether or not it can enter this directory, so the default is all permissions are open, that is, 777 points

Examples:
Assuming that your umask is 003, will the Umask case create files with directory permissions?
For:
Umask is 003, so take off the permissions for--------WX, so:
File: (-rw-rw-rw-)-(--------wx) =-rw-rw-r--
Catalog: (drwxrwxrwx)-(--------wx) = drwxrwxr--

Directory and file permissions meaning

[Meaning of permissions to a file] [Meaning of permissions to the directory]

The meaning of the permissions to the file:

• R (Read): Can read the actual contents of this file, such as reading the text file content, etc.;
• W (write): You can edit, add, or modify the contents of the file (without deleting the file);
• X (Execute): The file has permissions that can be executed by the system.
  

  The ability to execute a file under Windows is determined by "extension", for example:. exe,. bat,. com, and so on
  Under Linux, whether or not our files can be executed is determined by having the "X" Permission! There's no absolute relationship with the file name.

The meaning of permissions on the directory:

• R (Read contents in directory):
  Represents a permission to read a list of directory structures, so when you have read (r) permissions for a directory, you can query the file name data under that directory. So you can use the LS command to display the table of contents of this directory!
• W (Modify contents of directory):
1. Creation of new documents and directories;
2. Delete files and directories that already exist, regardless of the permissions of the file! )
3. Renaming a file or directory that already exists;
4. Move the files and directory locations within the directory.
• X (Access directory):
  The user has access to the directory as the working directory

It can be seen that if a person wants to enter the directory must have x this permission to the directory, but only have x this permission to enter the directory is meaningless, because you cannot read the file under the directory. So you want to let individuals enter the directory and can read the file structure under the directory must have X and r two permissions

Linux file types and extensions

[File Type] [Linux file extension] [Linux file length limit]

We have always emphasized a concept in the basic article, that is: Any device under Linux is a file

File type: the

• regular files (regular file): is the type of file that we are accessing, in terms of the attributes shown by Ls-al, the first character is [-], for example [-rwxrwxrwx]. In addition, according to the contents of the document, it can be divided into:
  1. Plain text file (ASCII): content is data that we humans can read directly, such as numbers, letters, etc.
  2. Binary (binary): Executable in Linux (scripts, text batch file not counted) is this format.
  3. Data format files: Some programs read certain formats of files during operation, and those files in a particular format can be referred to as data files. For example, when a user logs on, our Linux logs the logged-in data to the/var/log/ Wtmp in that file, the file is a data file that he can read through the last command! But when using cat, it reads garbled, because he is a file in a special format.
• Catalog (directory):
• link file (link)：

  1. Hard Link (entity links, rigid links or actual links):

     First, each file occupies an inode, and the file content is pointed to by the Inode record, and to read the file, you must go through the directory record's file name to point to the correct inode number to read.

     In other words, the file name is only related to the directory, but the contents of the document are related to the inode. Simply put: Hard link simply adds a file name to a connected record in a directory linked to an inode number. Implement multiple document names corresponding to the same inode number

     For example, suppose I have a system with a/root/crontab. He is a/etc/crontab entity link, which means that the two files are linked to the same inode, and naturally all relevant information for the two filenames will be identical (except for the file name). The actual situation can be as follows:

     [Email protected] ~]# Ln/etc/crontab. <== commands for creating entity links
     [Email protected] ~]# ll-i/etc/crontab/root/crontab
     1912701-rw-r--r--2 root root 255 Jan 6 2007/etc/crontab
     1912701-rw-r--r--2 root root 255 Jan 6 2007/root/crontab

     You can find two file names linked to 1912701 this inode number, because these two "file name" is actually the same "files"! And you will find that the second field is 2 from the original 1! The field is called a "link" and the meaning of this field is "How many file names are linked to this inode number". If you're drawing the correct data, you'll see a picture like this:

     Description

     1. Two different file names can be found by the block specified in the inode of the 1 or 2 directory, regardless of which file name can be used to refer to real that inode to read the final data!
     2. If you delete any "file name", the Inode and the block are still there! You can now read the correct file data through another "file name"!
     3. Regardless of which "file name" you use to edit, the final result will be written to the same inode and block, so the data can be modified!

     Requirements:

     1. Cannot cross Filesystem
     2. Cannot link directory.
  2. Symbolic Link (symbolic link, i.e. shortcut)

     Compared to hard link, symbolic link can be a good understanding, basically, symbolic link is to create a separate file, and this file will let the data read to the file of his link's filename! Since the file is only used to point to the action, so when the source file is deleted, Symbolic Link's file will "not open", will always say "unable to open a file!" ". In fact, the original" file name "is not found!

     For example, let's first create a symbolic link file to link to/etc/crontab to see:

     [Email protected] ~]# ln-s/etc/crontab crontab2
     [Email protected] ~]# ll-i/ETC/CRONTAB/ROOT/CRONTAB2
     1912701-rw-r--r--2 root root 255 Jan 6 2007/etc/crontab
     654687 lrwxrwxrwx 1 root root the Oct 13:58/root/crontab2-/etc/crontab

     As a result of the above table we can know that two files point to different inode numbers, of course, two separate files exist! And the important part of the link is that he will write the "filename" of the target file, and you can find out why the size of the link file in the table is bytes. Because the arrow (--) to the right of the file name "/etc/crontab" total of 12 English, each English occupies 1 byes, so the file size is 12bytes!

     For the above explanations, we explain them as follows:

     1th Inode reads the contents of the link file with only the file name, links to the correct directory according to the file name to obtain the inode of the target file, and finally the correct data can be read. What you can find is that if the target file (/etc/crontab) is deleted, Then the whole link will not be able to continue, so there will be unable to read through the link file problems!

     Here still have to pay special attention, this symbolic link and Windows shortcut can be equal to him, the file created by symbolic link is a separate new file, so will take up the inode and block Oh!

• device and device files: Some files related to the perimeter and storage of the system are usually concentrated in the/dev directory! It is usually divided into two types:
  1. Block device file: is some storage data to provide system random access to the interface device, for example, hard disk and floppy disk and so on! You can read and write randomly in different chunks of the hard drive, and this device is a group device! You can check the/DEV/SDA yourself, and you will find the first property is [B] Oh!
  2. Character (character) device files: This is the interface device for some serial ports, such as keyboards, mice, and so on! The features of these devices are "one-time read" and cannot truncate the output. For example, you can't let the mouse "jump" to another screen, but instead "swipe" to another place! The first property is [C].
• Data Interface file (sockets): Since it is called a data interface file, it is assumed that this type of file is usually used for data on the network. We can start a program to listen to the client's requirements, The client can communicate the data through the socket. The first property is [s], which is most commonly seen in the/var/run directory.
• Data Transfer file (FIFO, pipe): FIFO is also a special type of file, and his main purpose is to solve the errors caused by multiple programs accessing a file simultaneously. FIFO is the abbreviation for First-in-first-out. The first property is [P].

Linux file extension

Basically, the name of the file on the Linux system really just lets you know what the file might be used for, and the actual execution will still require permission specification! But if you can succeed, you have to look at the contents of the file.

Nevertheless, we still want to be able to understand what the file is by extension, so we will usually use the appropriate extension to indicate what kind of file it is. There are several common extensions below:

• *.sh: script or batch file (scripts), because the batch file is written using the shell, so the extension is compiled. Sh;
• *z, *.tar, *.tar.gz, *.zip, *.tgz: Packaged compressed files. This is because the compression software is gunzip, tar and so on, due to different compression software, and take its associated extension!
• *.html, *.php: Web-related files, respectively, representing HTML syntax and PHP syntax of the Web page file!. html files can be opened directly using the Web browser, as for. php files, you can browse through the server side of the client browser to get the operation The results of the Web page!

Linux file length limit

Under Linux, when using a preset ext2/ext3 file system, the file name length is limited to :

• The maximum allowable file name of a single file or directory is 255 characters;
• The full file name containing the full path name and directory (/) is 4,096 characters.

limitations of the Linux file name :

Because of the Linux in the text interface some of the instructions to operate the relationship, in general, you set the name of Linux under the file, it is best to avoid some special characters better! For example under these:

* ? > <; &! [ ] | \ ' "' () {}

Because these symbols in the text interface, there is a special meaning! Additionally, the file name begins with the decimal point "." , this file is "hidden file". At the same time, because of the command release, often use the-option and other options, so you'd better avoid the file name at the beginning of the name of-or +!

Go Properties of Linux files and directories