Linux file system permissions sequence

Use the program:

chmod setfacl getfacl Stat chattr lsattr

chmod: Setting File permissions

SETFACL: Setting access Control lists (Access controls list)

Getfacl: View access Control List

Stat: Display inode content (a|m|c) time content

Chattr: Set the list file property system for the second extension file

Lsattr: View the list file property system for the second extension file

Setuid: Make the file have the same X permissions as the file owner

Setgid: Make folder have the same X permissions as the file group

Sticky: Make the file not to be book

Test:

[Root@nagios test]# setuid setgid sticky [root@nagios test]# chown-r nagios.nagios./[Root@nagios test]#] chmod U+s setuid && chmod g+s setgid && chmod o+t Sticky [root@nagios test]# ll total 0-rw-r-sr--1 Nagios na Gios 0 00:41 setgid-rwsr--r--1 nagios nagios 0 Mar 00:41 setuid-rw-r--r-t 1 nagios nagios 0 Mar 00:41 St 
Icky [Root@nagios test]# su Hello [hello@nagios test]$ pwd/root/test [Hello@nagios test]$ echo Hello >> setuid Bash:setuid:Permission denied [hello@nagios test]$ sh setuid hello [nagios@nagios test]$ exit exit [Root@nagios TE st]# chmod o+w Sticky [root@nagios test]# su Hello [hello@nagios test]$ ll STICKY-RW-RW-RWT 1 nagios nagios 0 Mar 28 0 0:45 Sticky [hello@nagios test]$ rm sticky rm:cannot remove ' sticky ': Permission denied [Hello@nagios test]$ stat-Stic    KY file: ' Sticky ' size:0 blocks:0 IO block:4096 regular empty file device:fd00h/64768d inode:134198 LinKs:1 Access: (1666/-RW-RW-RWT) Uid: (500/nagios) Gid: (500/nagios) access:2013-03-28 00:45:37.875928997 +080 0 modify:2013-03-28 00:45:37.875928997 +0800 change:2013-03-28 00:46:28.050580800 +0800

#setfacl and Getfacl

User:: User: Is the main permission "::" Are the main ":" For special users

Group:: Team: Groups and special groups

Other:: Others

Mask:: Everyone except the Lord and others

Common options:

-D: Subdirectories inherit special permissions from the parent directory.

-r: Recursive permissions

To see if ACLs are supported

[Root@nagios heelo]# tune2fs-l/dev/sda1 | grep option 
Default mount options:    user_xattr ACLs

Test

[Root@nagios test]# Touch Setfacl 
[root@nagios test]# setfacl-m user::r,user:hello:rw setfacl 
[Root@nagios test]# chown nagios.nagios setfacl 
[Root@nagios test]# ll Setfacl 
-r--rw-r--+ 1 nagios nagios 0 Mar 00:52 CL 
[Root@nagios test]# su nagios 
[Nagios@nagios test]$ echo Hello >> setfacl 
bash:setfacl:Permission Denied 
[Nagios@nagios test]$ exit 
exit 
[Root@nagios test]# su Hello 
[hello@nagios test]$ echo Hello & gt;> setfacl 
[Hello@nagios test]$ cat setfacl 
Hello 
[hello@nagios test]$ getfacl setfacl 
# File : Setfacl 
# owner:nagios 
# group:nagios 
user::r-- 
user:hello:rw-group::r--mask 
:: rw- 
other::r--

#chattr and Lsattr

Chattr +-=[ACDEIJSTUADST].

A:atime, tell the system not to modify the last access time for this file.

S:sync, once the application performs a write operation on the file, the system immediately writes the resulting changes to the disk.

A:append only, the system allows you to append data only after this file, and does not allow any process to overwrite or truncate the file. If the directory has this attribute, the system will only be allowed to create and modify files in this directory, and not delete any files.

I:immutable, the system is not allowed to make any modifications to this file. If the directory has this attribute, any process can only modify the files under the directory and not allow the creation and deletion of files.

D: Check for errors in the compressed file.

D:no dump, the DUMP program ignores this file when making a file system backup.

C:compress, the system compresses the file in a transparent way. When read from this file, the extracted data is returned, and when the data is written to the file, the data is first compressed before it is written to disk.

S:secure Delete to let the system use 0 to populate the area where the file is located when the file is deleted.

U:undelete, when an application requests that the file be deleted, the system retains its block of data so that it can be restored after the file is deleted.

Test

[Root@nagios test]# mkdir chattr 
[root@nagios test]# chattr +i chattr/ 
[Root@nagios test]# Touch Chattr/hello
  touch:cannot Touch ' Chattr/hello ': Permission denied 
[Root@nagios test]# chattr-i +a chattr/ 
[Root@nagios tes t]# Touch Chattr/hello && echo Hello >>chattr/hello && cat chattr/hello 
Hello 
[ Root@nagios test]# RM Chattr/hello 
rm:remove Regular file ' Chattr/hello ' y 
rm:cannot remove ' Chattr/hello ': Ope Ration not permitted