Linux file System special permissions and Suid sgid sticky

Linux file System special permissions and Suid sgid sticky

1. Special permissions on Linux file systems

Permission model:

U, G, O

R, W, X

2. The security context of the process:

Prerequisite: The process is owned by the owner (the process is running as the user's identity);

(1) Whether the user can start an executable program file as a process, depending on whether the user has Execute permission on the program file;

(2) After the program is started as a process, the owner of the process is the current user, the initiator of the process, the group to which the process belongs, and the base group for the initiator;

(3) The access rights of the process, depending on the owner's access rights:

(a) The owner of the process and the owner of the document, the application document is the master authority;

(b) The owner of the process, belonging to the group of documents, the application file is a group of permissions;

(c) Apply other rights;

3, SUID:

(1) Any executable program file can be started as a process: depending on whether the initiator has EXECUTE permission on the program file;

(2) After initiating as a process, its owner is not the initiator, and the program file is the owner of its own, the mechanism is suid;

Permission settings:

chmod u+s FILE ...

chmod u-s FILE ...

Attention:

S: The owner of the original X permission;

S: The original owner has no x permission;

4, SGID:

By default, when a user creates a file, it belongs to the base group that the user is a member of;

Function: Once a directory has been set Sgid permissions, the user who has write permission to this directory belongs to the group of directories, not the user's base group;

Permission settings:

chmod g+s FILE ...

chmod g-s FILE ...

5, Sticky:

Role: For a multi-person writable directory, this permission is used to restrict each can only delete their own files;

Permission settings

chmod o+t FILE ...

chmod o-t FILE ...

SUID, SGID, STICKY

000

001

010

011

100

101

110

111

chmod 4777 FILE

chmod 3755 DIR

6. File System attribute chattr permissions

chattr [+,-, =] [options] file or directory name

Options:

I: If the file set I property, then the file is not allowed to delete, renamed, and can not add and modify data;

If you set the I property on the directory, you can only modify the data of the files in the directory, but not the file creation and deletion, or rename

A: If you set a property to the file, you can only add data to the file, but you cannot delete or modify the data; You can only use redirects to join the data.

If you set a property on the directory, only the files are allowed to be created and modified in the directory, but the files are not allowed to be deleted

Example:

[[email protected] ~]# chattr +ia/etc/fstab[[email protected] ~]# lsattr/etc/fstab----ia-------e-/etc/fstab[[email Pro Tected] ~]# chattr-ia/etc/fstab[[email protected] ~]# lsattr/etc/fstab-------------e-/etc/fstab

7. View File System Properties

Lsattr option file name

-A show all files and directories

-D If the target is a directory, list only the properties of the directory itself, not the properties of the child file

Example:

[Email protected] ~]# lsattr-a/usr/local/*-------------e-/usr/local/bin/.-------------e-/usr/local/bin/. -------------e-/usr/local/etc/.-------------e-/usr/local/etc/. -------------e-/usr/local/games/.

6. Sudo permissions

Root assigns commands that can only be executed by administrators to ordinary users

Use of sudo

Visudo opening the/etc/sudoers configuration file

1.lisir All=nopasswd:/sbin/service,/sbin/ifconfig,/bin/mount

The above command does not enter a password

2.lisir Station 73=/sbin/service/,nopasswd:/sbin/ifconfig,/bin/mount

A password is required to execute the service command, Ifconfig,mount does not need

3.lisir station73= (Poppy)/sbin/service,nopasswd: (Root)/bin/mount

A user can execute certain commands for multiple users

4.%stu station=nopasswd:networking./bin/

Users in the Stu group can not enter the networking that are defined in the user password execution file, as well as the commands under directory/bin. Do you remember? Must be added/terminated after the directory

5.poppy all= (All) all

This command is dangerous. It is poppy the user can execute any command on any host with any user.

Sudo is characterized by giving users as few permissions as possible, but doing their job, all while editing sudoers files, be careful not to allow illegal users to intercept root permissions.

example:

[[email protected] ~]# visudo## allow root  to run any commands anywhereroot    all= (All)         alllisir   all=/sbin/fdisk[[email protected] ~]# su  - lisir[[email protected] ~]$ sudo fdisk -l[sudo] password for  lisir:Disk /dev/sda: 128.8 GB, 128849018880 bytes255 heads, 63  sectors/track, 15665 cylindersunits = cylinders of 16065 * 512 =  8225280 bytesSector size  (logical/physical): 512 bytes / 512  bytesi/o size  (Minimum/optimal):  512 bytes / 512 bytesdisk identifier:  0x00048e25 

Practice:

1, so that ordinary users can use/tmp/cat to view/etc/shadow files;

For:

[Email protected] ~]# cp-rfp/bin/cat/tmp

[Email protected] ~]# chmod u+s/tmp/cat

[Email protected] ~]# Su-lisir

[Email protected] ~]$/tmp/cat/etc/shadow

2, create the directory/test/data, let a group of ordinary users have write permission to it, and all the files created by the group of directories belong to the group, in addition, each user can only delete their own files;

For:

[Email protected] ~]# mkdir-p/test/data

[Email protected] ~]# chmod g+s/test/data/

[Email protected] ~]# chmod o+t/test/data/

[Email protected] ~]# Chown:lisir/test/data

[Email protected] ~]# chmod g+w/test/data/

Linux file System special permissions and Suid sgid sticky