| Red Hat Certified System Administration 8 |
Chapter 07: Permissions ManagementSommaire
Managing File OwnershipOwnershipchown Command [+][root@lab ~]# chown -option user:group fichier[root@lab ~]# chown -option user:group répertoire/ [root@lab ~]# chown lisa myfile Sets user lisa as the owner of myfile [root@lab ~]# chown lisa.sales myfile Sets user lisa as user owner and group sales as group owner of myfile [root@lab ~]# chown lisa:sales myfile Sets user lisa as user owner and group sales as group owner of myfile [root@lab ~]# chown .sales myfile Sets group sales as group owner of myfile without changing the user owner [root@lab ~]# chown :sales myfile Sets group sales as group owner of myfile without changing the user owner Managing Basic PermissionsPermissionsLes permissions sur les fichiers sont codés sur 3 bits- Le bit du poids le plus faible 20 pour le execute (x) - le bit du milieu 21 pour le write (w) - Le bit du poids fort 22 pour le read (r) Les permissions sur un fichier sont affichées par le output de la commande ls -l r = 1 x 22 = 4 w = 1 x 21 = 2 w = 1 x 20 = 1 Configuration
First Method Cette méthode consiste à ajouter ou à supprimer des permissions [root@lab ~]# chmod user+privilege file ajouter un privilege [root@lab ~]# chmod user-privilege file retirer un privilege NB: les privileges peuvent etre associés comme suit rw, rx,wx, rwx Exemple [root@lab ~]# chmod u+wx,g-w,o-wx /home/content.txt Second Method  [root@lab ~]# chmod ugo file u represents user total g represents group total o represents other total exple chmod 777 file [+] Managing Advanced PermissionsAdvanced PermissionsApart from the basic permissions that you have just read about, Linux has a set of advanced permissions as well. These are not permissions that you would set by default, but they sometimes provide a useful addition to realize more advanced scenarios. In this section, you learn what they are and how to set them. Understanding Advanced PermissionsThere are three advanced permissions. The first of them is the set user ID (SUID) permission. On some very specific occasions, you may want to apply this permission to executable files. By default, a user who runs an executable file runs this file with his own permissions. For normal users, that usually means that the use of the program is restricted. In some cases, however, the user needs special permissions, just for the execution of a certain task. Managing ACLsSetting Default Permissions with umaskUMASKThe setting which determines what permissions are applied to a newly created file or directoryis called a umask and is configured in the /etc/.bashrc file Displaying umask[root@lab ~]# umask Display umask valueby default umask=002 for users umask=022 for root [root@lab ~]# umask 0002 A breakdown of the output: • The first 0 indicates that the umask is given as an octal number. • The second 0 indicates which permissions to subtract from the default user owner's permissions. • The third 0 indicates which permissions to subtract from the default group owner's permissions. • The last number 2 indicates which permissions to subtract from the default other's permissions. Default Permissions DeterminationWe can determine directories and files default permissions using umask valueMethod 1 777 - umask = abc directories default access rights abc - klm = xyz files default access rights k =1 si a est impair et k= 0 si a est pair l =1 si b est impair et l= 0 si b est pair m =1 si c est impair et l= 0 si c est pair NB:Plus precisement on retire les permissions x sur les permissions des repertoires pour trouver les permissions des fichiers Example 777 – 002 = 775 – 111 = 664 775= directories default access rights 664= files default access rights
Modify umask[user1@lab ~]# umask value change temporary umask value Insert command in .bashrc file for permanent ModificationWorking with User-Extended AttributesAttributesWhen you work with permissions, a relationship always exists between a user or group object and the permissions these user or group objects have on a file or directory. An alternative method of securing files on a Linux server is by working with attributes. Attributes do their work regardless of the user who accesses the file. As is the case for ACLs, for file attributes a mount option, user_xattr, may have to be enabled. If you are getting an “operation not supported” message while working with user-extended attributes, make sure to set this mount option in the /etc/fstab file. Many attributes are documented. Some attributes are available but not yet implemented. Do not use them; they bring you nothing. Following are the most useful attributes that you can apply: • A This attribute ensures that the file access time of the file is not modified. Normally, every time a file is opened, the file access time must be written to the file’s metadata. This affects performance in a negative way; therefore, on files that are accessed on a regular basis, the A attribute can be used to disable this feature.• a This attribute allows a file to be added to but not to be removed. • c If you are using a file system where volume level compression is supported, this file attribute makes sure that the file is compressed the first time the compression engine becomes active. • D This attribute makes sure that changes to files are written to disk immediately, and not to cache first. This is a useful attribute on important database files to make sure that they do not get lost between file cache and hard disk. • d This attribute makes sure the file is not backed up in backups where the dump utility is used. • I This attribute enables indexing for the directory where it is enabled. This allows faster file access for primitive file systems like Ext3 that do not use a B-tree database for fast access to files. • i This attribute makes the file immutable. Therefore, no changes can be made to the file at all, which is useful for files that need a bit of extra protection. • j This attribute ensures that on an Ext3 file system the file is first written to the journal and only after that to the data blocks on the hard disk. • s This attribute overwrites the blocks where the file was stored with 0s after the file has been deleted. This makes sure that recovery of the file is not possible after it has been deleted. • u This attribute saves undelete information. This allows a utility to be developed that works with that information to salvage deleted files. Note Although there are quite a few attributes that can be used, be aware that most attributes are rather experimental and are only of any use if an application is used that can work with the given attribute. For example, it does not make sense to apply the u attribute if no application has been developed that can use this attribute to recover deleted files. If you want to apply attributes, you can use the chattr command. For example, use chattr +s somefile to apply the attributes to somefile. Need to remove the attribute again? Then use chattr -s somefile and it will be removed. To get an overview of all attributes that are currently applied, use the lsattr command. |
