Linux File System permission collation

Linux File System permission collation

Programs used:

Chmod setfacl getfacl stat chattr lsattr
Chmod: Set File Permissions
Setfacl: access control list)
Getfacl: view the access control list
Stat: displays inode content (a | m | c) time content
Chattr: sets the list file attribute system of the second extended file.
Lsattr: view the list file attribute system of the second extension file
Setuid: Make the file have the same x permissions as the file owner
Setgid: Make the folder have the same x permissions as the file group
Sticky: Make files unavailable

Test:

1. [Root @ nagios test] # touch setuid setgid sticky
2. [Root @ nagios test] # chown-R nagios. nagios ./
3. [Root @ nagios test] # chmod u + s setuid & chmod g + s setgid & chmod o + t sticky
4. [Root @ nagios test] # ll
5. Total 0
6. -Rw-r-Sr -- 1 nagios 0 Mar 2800: 41 setgid
7. -RwSr -- r -- 1 nagios 0 Mar 2800: 41 setuid
8. -Rw-r -- r-T 1 nagios 0 Mar 2800: 41 sticky
9. [Root @ nagios test] # su hello
10. [Hello @ nagios test] $ pwd
11. /Root/test
12. [Hello @ nagios test] $ echo hello> setuid
13. Bash: setuid: Permission denied
14. [Hello @ nagios test] $ sh setuid
15. Hello
16. [Nagios @ nagios test] $ exit
17. Exit
18. [Root @ nagios test] # chmod o + w sticky
19. [Root @ nagios test] # su hello
20. [Hello @ nagios test] $ ll sticky
21. -Rw-rwT 1 nagios 0 Mar 2800: 45 sticky
22. [Hello @ nagios test] $ rm sticky
23. Rm: cannot remove 'sticky': Permission denied
24. [Hello @ nagios test] $ stat sticky
25. File: 'sticky'
26. Size: 0 Blocks: 0 IO Block: 4096 regular empty file
27. Device: fd00h/64768d Inode: 134198 Links: 1
28. Access: (1666/-rw-rwT) Uid: (500/nagios) Gid: (500/nagios)
29. Access: 2013-03-2800: 45: 37.875928997 + 0800
30. Modify: 2013-03-2800: 45: 37.875928997 + 0800
31. Change: 2013-03-2800: 46: 28.050580800 + 0800

# Setfacl and getfacl

User: owner permission ":" All are owners ":" special user Group: group and Special group Other: Others Mask: All persons except owner and others Common options: -D: subdirectory inherits the special permissions of the parent directory. -R: recursive permission

Check whether ACL is supported

1. [Root @ nagios heelo] # tune2fs-l/dev/sda1 | grep option
2. Default mount options: user_xattr acl

Test:

1. [Root @ nagios test] # touch setfacl
2. [Root @ nagios test] # setfacl-m user: r, user: hello: rw setfacl
3. [Root @ nagios test] # chown nagios. nagios setfacl
4. [Root @ nagios test] # ll setfacl
5. -R -- rw-r -- + 1 nagios 0 Mar 2800: 52 setfacl
6. [Root @ nagios test] # su nagios
7. [Nagios @ nagios test] $ echo hello> setfacl
8. Bash: setfacl: Permission denied
9. [Nagios @ nagios test] $ exit
10. Exit
11. [Root @ nagios test] # su hello
12. [Hello @ nagios test] $ echo hello> setfacl
13. [Hello @ nagios test] $ cat setfacl
14. Hello
15. [Hello @ nagios test] $ getfacl setfacl
16. # File: setfacl
17. # Owner: nagios
18. # Group: nagios
19. User: r --
20. User: hello: rw-
21. Group: r --
22. Mask: rw-
23. Other: r --

#chattr and lsattr

Chattr +-= [acdeijstuADST]. A: Atime: Tell the system not to modify the last access time of this file. S: Sync. Once the application writes the file, the system immediately writes the Modification result to the disk. A: Append Only. The system Only allows data to be appended to this file. No process is allowed to overwrite or intercept this file. If the directory has this attribute, the system will only allow the creation and modification of files under this directory, and will not allow the deletion of any files. I: Immutable. The system does not allow any modifications to this file. If the directory has this attribute, any process can only modify the files under the Directory and cannot create or delete files. D: Check for errors in the compressed file. D: No dump. During file system backup, the dump program ignores this file. C: Compress. The system compresses the file transparently. When reading from this file, the returned data is extracted. When writing data to this file, the data is first compressed before being written to the disk. S: Secure Delete. The system will use 0 to fill in the region where the file is located when deleting the file. U: Undelete: When an application requests to delete this file, the system will keep its data block so that the file can be deleted in the future.

Test:

1. [Root @ nagios test] # mkdir chattr
2. [Root @ nagios test] # chattr + I chattr/
3. [Root @ nagios test] # touch chattr/hello
4. Touch: cannot touch 'chattr/hello': Permission denied
5. [Root @ nagios test] # chattr-I + a chattr/
6. [Root @ nagios test] # touch chattr/hello & echo hello> chattr/hello & cat chattr/hello
7. Hello
8. [Root @ nagios test] # rm chattr/hello
9. Rm: remove regular file 'chattr/hello '? Y
10. Rm: cannot remove 'chattr/hello': Operation not permitted

Conclusion