mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-26 21:30:55 +08:00
geekpi
GitHub
commit
1e1ed4eedf
@ -1,172 +0,0 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (A deeper dive into Linux permissions)
|
||||
[#]: via: (https://www.networkworld.com/article/3397790/a-deeper-dive-into-linux-permissions.html)
|
||||
[#]: author: (Sandra Henry-Stocker https://www.networkworld.com/author/Sandra-Henry_Stocker/)
|
||||
|
||||
A deeper dive into Linux permissions
|
||||
======
|
||||
Sometimes you see more than just the ordinary r, w, x and - designations when looking at file permissions on Linux. How can you get a clearer view of what the uncommon charactrers are trying to tell you and how do these permissions work?
|
||||
![Sandra Henry-Stocker][1]
|
||||
|
||||
Sometimes you see more than just the ordinary **r** , **w** , **x** and **-** designations when looking at file permissions on Linux. Instead of **rwx** for the owner, group and other fields in the permissions string, you might see an **s** or **t** , as in this example:
|
||||
|
||||
```
|
||||
drwxrwsrwt
|
||||
```
|
||||
|
||||
One way to get a little more clarity on this is to look at the permissions with the **stat** command. The fourth line of stat’s output displays the file permissions both in octal and string format:
|
||||
|
||||
```
|
||||
$ stat /var/mail
|
||||
File: /var/mail
|
||||
Size: 4096 Blocks: 8 IO Block: 4096 directory
|
||||
Device: 801h/2049d Inode: 1048833 Links: 2
|
||||
Access: (3777/drwxrwsrwt) Uid: ( 0/ root) Gid: ( 8/ mail)
|
||||
Access: 2019-05-21 19:23:15.769746004 -0400
|
||||
Modify: 2019-05-21 19:03:48.226656344 -0400
|
||||
Change: 2019-05-21 19:03:48.226656344 -0400
|
||||
Birth: -
|
||||
```
|
||||
|
||||
This output reminds us that there are more than nine bits assigned to file permissions. In fact, there are 12. And those extra three bits provide a way to assign permissions beyond the usual read, write and execute — 3777 (binary 011111111111), for example, indicates that two extra settings are in use.
|
||||
|
||||
The first **1** (second bit) in this particular value represents the SGID (set group ID) and assigns temporary permission to run the file or use the directory with the permissions of the associated group.
|
||||
|
||||
```
|
||||
011111111111
|
||||
^
|
||||
```
|
||||
|
||||
**SGID** gives temporary permissions to the person using the file to act as a member of that group.
|
||||
|
||||
The second **1** (third bit) is the “sticky” bit. It ensures that _only_ the owner of the file is able to delete or rename the file or directory.
|
||||
|
||||
```
|
||||
011111111111
|
||||
^
|
||||
```
|
||||
|
||||
Had the permissions been 7777 rather than 3777, we’d have known that the SUID (set UID) field had also been set.
|
||||
|
||||
```
|
||||
111111111111
|
||||
^
|
||||
```
|
||||
|
||||
**SUID** gives temporary permissions to the user using the file to act as the file owner.
|
||||
|
||||
As for the /var/mail directory which we looked at above, all users require some access so some special values are required to provide it.
|
||||
|
||||
But now let’s take this a step further.
|
||||
|
||||
One of the common uses of the special permission bits is with commands like the **passwd** command. If you look at the /usr/bin/passwd file, you’ll notice that the SUID bit is set, allowing you to change your password (and, thus, the contents of the /etc/shadow file) even when you’re running as an ordinary (not a privileged) user and have no read or write access to this file. Of course, the passwd command is clever enough not to allow you to change other people's passwords unless you are actually running as root or using sudo.
|
||||
|
||||
```
|
||||
$ ls -l /usr/bin/passwd
|
||||
-rwsr-xr-x 1 root root 63736 Mar 22 14:32 /usr/bin/passwd
|
||||
$ ls -l /etc/shadow
|
||||
-rw-r----- 1 root shadow 2195 Apr 22 10:46 /etc/shadow
|
||||
```
|
||||
|
||||
Now, let’s look at what you can do with the these special permissions.
|
||||
|
||||
### How to assign special file permissions
|
||||
|
||||
As with many things on the Linux command line, you have some choices on how you make your requests. The **chmod** command allows you to change permissions numerically or using character expressions.
|
||||
|
||||
To change file permissions numerically, you might use a command like this to set the setuid and setgid bits:
|
||||
|
||||
```
|
||||
$ chmod 6775 tryme
|
||||
```
|
||||
|
||||
Or you might use a command like this:
|
||||
|
||||
```
|
||||
$ chmod ug+s tryme <== for SUID and SGID permissions
|
||||
```
|
||||
|
||||
If the file that you are adding special permissions to is a script, you might be surprised that it doesn’t comply with your expectations. Here’s a very simple example:
|
||||
|
||||
```
|
||||
$ cat tryme
|
||||
#!/bin/bash
|
||||
|
||||
echo I am $USER
|
||||
```
|
||||
|
||||
Even with the SUID and SGID bits set and the file root-owned file, running a script like this won’t yield the “I am root” response you might expect. Why? Because Linux ignores the set-user-ID and set-group-ID bits on scripts.
|
||||
|
||||
```
|
||||
$ ls -l tryme
|
||||
-rwsrwsrwt 1 root root 29 May 26 12:22 tryme
|
||||
$ ./tryme
|
||||
I am jdoe
|
||||
```
|
||||
|
||||
If you try something similar using a compiled program, on the other hand, as with this simple C program, you’ll see a different effect. In this example program, we prompt the user to enter a file and create it for them, giving the file write permission.
|
||||
|
||||
```
|
||||
#include <stdlib.h>
|
||||
|
||||
int main()
|
||||
{
|
||||
FILE *fp; /* file pointer*/
|
||||
char fName[20];
|
||||
|
||||
printf("Enter the name of file to be created: ");
|
||||
scanf("%s",fName);
|
||||
|
||||
/* create the file with write permission */
|
||||
fp=fopen(fName,"w");
|
||||
/* check if file was created */
|
||||
if(fp==NULL)
|
||||
{
|
||||
printf("File not created");
|
||||
exit(0);
|
||||
}
|
||||
|
||||
printf("File created successfully\n");
|
||||
return 0;
|
||||
}
|
||||
```
|
||||
|
||||
Once you compile the program and run the commands for both making root the owner and setting the needed permissions, you’ll see that it runs with root authority as expected — leaving a newly created root-owned file. Of course, you must have sudo privileges to run some of the required commands.
|
||||
|
||||
```
|
||||
$ cc -o mkfile mkfile.c <== compile the program
|
||||
$ sudo chown root:root mkfile <== change owner and group to “root”
|
||||
$ sudo chmod ug+s mkfile <== add SUID and SGID permissions
|
||||
$ ./mkfile <== run the program
|
||||
Enter name of file to be create: empty
|
||||
File created successfully
|
||||
$ ls -l empty
|
||||
-rw-rw-r-- 1 root root 0 May 26 13:15 empty
|
||||
```
|
||||
|
||||
Notice that the file is owned by root — something that wouldn’t have happened if the program hadn’t run with root authority.
|
||||
|
||||
The positions of the uncommon settings in the permissions string (e.g., rw **s** rw **s** rw **t** ) can help remind us what each bit means. At least the first "s" (SUID) is in the owner-permissions area and the second (SGID) is in the group-permissions area. Why the sticky bit is a "t" instead of an "s" is beyond me. Maybe the founders imagined referring to it as the "tacky bit" and changed their minds due to less flattering second definition of the word. In any case, the extra permissions settings provide a lot of additional functionality to Linux and other Unix systems.
|
||||
|
||||
Join the Network World communities on [Facebook][2] and [LinkedIn][3] to comment on topics that are top of mind.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.networkworld.com/article/3397790/a-deeper-dive-into-linux-permissions.html
|
||||
|
||||
作者：[Sandra Henry-Stocker][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://www.networkworld.com/author/Sandra-Henry_Stocker/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://images.idgesg.net/images/article/2019/05/shs_rwsr-100797564-large.jpg
|
||||
[2]: https://www.facebook.com/NetworkWorld/
|
||||
[3]: https://www.linkedin.com/company/network-world
|
||||
173
translated/tech/20190527 A deeper dive into Linux permissions.md
Normal file
173
translated/tech/20190527 A deeper dive into Linux permissions.md
Normal file
@ -0,0 +1,173 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (geekpi)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (A deeper dive into Linux permissions)
|
||||
[#]: via: (https://www.networkworld.com/article/3397790/a-deeper-dive-into-linux-permissions.html)
|
||||
[#]: author: (Sandra Henry-Stocker https://www.networkworld.com/author/Sandra-Henry_Stocker/)
|
||||
|
||||
更深入地了解 Linux 权限
|
||||
======
|
||||
在 Linux 上查看文件权限时，有时你会看到的不仅仅是普通的 r、w、x 和 -。如何更清晰地了解这些字符试图告诉你什么以及这些权限如何工作？
|
||||
![Sandra Henry-Stocker][1]
|
||||
|
||||
在 Linux 上查看文件权限时，有时你会看到的不仅仅是普通的 **r**、**w**、**x** 和 **-**。除了在所有者、组和其他中看到 **rwx** 之外，你可能会看到 **s** 或者 **t**，如下例所示：
|
||||
|
||||
```
|
||||
drwxrwsrwt
|
||||
```
|
||||
|
||||
要进一步明确的方法之一是使用 **stat** 命令查看权限。stat 的第四行输出以八进制和字符串格式显示文件权限：
|
||||
|
||||
```
|
||||
$ stat /var/mail
|
||||
File: /var/mail
|
||||
Size: 4096 Blocks: 8 IO Block: 4096 directory
|
||||
Device: 801h/2049d Inode: 1048833 Links: 2
|
||||
Access: (3777/drwxrwsrwt) Uid: ( 0/ root) Gid: ( 8/ mail)
|
||||
Access: 2019-05-21 19:23:15.769746004 -0400
|
||||
Modify: 2019-05-21 19:03:48.226656344 -0400
|
||||
Change: 2019-05-21 19:03:48.226656344 -0400
|
||||
Birth: -
|
||||
```
|
||||
|
||||
该输出提示我们，分配给文件权限的位数超过 9 位。事实上，有 12 位。这些额外的三位提供了一种分配超出通常的读、写和执行权限的方法 - 例如，3777（二进制 011111111111）表示使用了两个额外的设置。
|
||||
|
||||
该值的第一个 **1** （第二位）表示 SGID（设置组 ID）并分配运行文件的临时权限或使用有关联组权限的目录。
|
||||
|
||||
```
|
||||
011111111111
|
||||
^
|
||||
```
|
||||
|
||||
**SGID** 将正在使用该文件的用户作为该组成员之一分配临时权限。
|
||||
|
||||
第二个 **1**（第三位）是“粘连”位。它确保_只有_文件的所有者能够删除或重命名文件或目录。
|
||||
|
||||
```
|
||||
011111111111
|
||||
^
|
||||
```
|
||||
|
||||
如果权限是 7777 而不是 3777，我们知道 SUID（设置 UID）字段也已设置。
|
||||
|
||||
```
|
||||
111111111111
|
||||
^
|
||||
```
|
||||
|
||||
**SUID** 将正在使用该文件的用户作为文件拥有者分配临时权限。
|
||||
|
||||
至于我们上面看到的 /var/mail 目录，所有用户都需要访问，因此需要一些特殊值来提供它。
|
||||
|
||||
但现在让我们更进一步。
|
||||
|
||||
特殊权限位的一个常见用法是使用 **passwd** 之类的命令。如果查看 /usr/bin/passwd 文件，你会注意到 SUID 位已设置，它允许你更改密码（以及 /etc/shadow 文件的内容），即使你是以普通（非特权）用户身份运行，并且对此文件没有读取或写入权限。当然，passwd 命令很聪明，不允许你更改其他人的密码，除非你是以 root 身份运行或使用 sudo。
|
||||
|
||||
```
|
||||
$ ls -l /usr/bin/passwd
|
||||
-rwsr-xr-x 1 root root 63736 Mar 22 14:32 /usr/bin/passwd
|
||||
$ ls -l /etc/shadow
|
||||
-rw-r----- 1 root shadow 2195 Apr 22 10:46 /etc/shadow
|
||||
```
|
||||
|
||||
现在，让我们看一下使用这些特殊权限可以做些什么。
|
||||
|
||||
### 如何分配特殊文件权限
|
||||
|
||||
与 Linux 命令行中的许多东西一样，你可以有不同的方法设置。 **chmod** 命令允许你以数字方式或使用字符表达式更改权限。
|
||||
|
||||
要以数字方式更改文件权限，你可以使用这样的命令来设置 setuid 和 setgid 位：
|
||||
|
||||
```
|
||||
$ chmod 6775 tryme
|
||||
```
|
||||
|
||||
或者你可以使用这样的命令：
|
||||
|
||||
```
|
||||
$ chmod ug+s tryme <== 用于 SUID 和 SGID 权限
|
||||
```
|
||||
|
||||
如果你要添加特殊权限的文件是脚本，你可能会对它不符合你的期望感到惊讶。这是一个非常简单的例子：
|
||||
|
||||
```
|
||||
$ cat tryme
|
||||
#!/bin/bash
|
||||
|
||||
echo I am $USER
|
||||
```
|
||||
|
||||
即使设置了 SUID 和 SGID 位，并且 root 是文件所有者，运行脚本也不会产生你可能期望的 “I am root”。为什么？因为 Linux 会忽略脚本的 setuid 和 setgid 位。
|
||||
|
||||
```
|
||||
$ ls -l tryme
|
||||
-rwsrwsrwt 1 root root 29 May 26 12:22 tryme
|
||||
$ ./tryme
|
||||
I am jdoe
|
||||
```
|
||||
|
||||
另一方面，如果你尝试编译程序之类，就像这个简单的 C 程序一样，你会看到不同的效果。在此示例程序中，我们提示用户输入文件名并创建它，并给文件写入权限。
|
||||
|
||||
```
|
||||
#include <stdlib.h>
|
||||
|
||||
int main()
|
||||
{
|
||||
FILE *fp; /* file pointer*/
|
||||
char fName[20];
|
||||
|
||||
printf("Enter the name of file to be created: ");
|
||||
scanf("%s",fName);
|
||||
|
||||
/* create the file with write permission */
|
||||
fp=fopen(fName,"w");
|
||||
/* check if file was created */
|
||||
if(fp==NULL)
|
||||
{
|
||||
printf("File not created");
|
||||
exit(0);
|
||||
}
|
||||
|
||||
printf("File created successfully\n");
|
||||
return 0;
|
||||
}
|
||||
```
|
||||
|
||||
Once you compile the program and run the commands for both making root the owner and setting the needed permissions, you’ll see that it runs with root authority as expected — leaving a newly created root-owned file. Of course, you must have sudo privileges to run some of the required commands.
|
||||
编译程序并运行命令以使 root 用户成为所有者并设置所需权限后，你将看到它以预期的 root 权限运行 - 留下新创建的 root 所有者文件。当然，你必须具有 sudo 权限才能运行一些需要的命令。
|
||||
|
||||
```
|
||||
$ cc -o mkfile mkfile.c <== 编译程序
|
||||
$ sudo chown root:root mkfile <== 更改所有者和组为 “root”
|
||||
$ sudo chmod ug+s mkfile <== 添加 SUID and SGID 权限
|
||||
$ ./mkfile <== 运行程序
|
||||
Enter name of file to be create: empty
|
||||
File created successfully
|
||||
$ ls -l empty
|
||||
-rw-rw-r-- 1 root root 0 May 26 13:15 empty
|
||||
```
|
||||
|
||||
请注意，文件所有者是 root - 如果程序未以 root 权限运行，则不会发生这种情况。
|
||||
|
||||
权限字符串中不常见设置的位置（例如，rw **s** rw **s** rw **t**）可以帮助提醒我们每个位的含义。至少第一个 “s”（SUID） 位于所有者权限区域中，第二个 （SGID） 位于组权限区域中。为什么粘连位是 “t” 而不是 “s” 超出了我的理解。也许创造者想把它称为 “tacky bit”，但由于这个词的不太令人喜欢的第二个定义而改变了他们的想法。无论如何，额外的权限设置为 Linux 和其他 Unix 系统提供了许多额外的功能。
|
||||
|
||||
在 [Facebook][2] 和 [LinkedIn][3] 上加入 Network World 社区来评论主题。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.networkworld.com/article/3397790/a-deeper-dive-into-linux-permissions.html
|
||||
|
||||
作者：[Sandra Henry-Stocker][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[geekpi](https://github.com/geekpi)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://www.networkworld.com/author/Sandra-Henry_Stocker/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://images.idgesg.net/images/article/2019/05/shs_rwsr-100797564-large.jpg
|
||||
[2]: https://www.facebook.com/NetworkWorld/
|
||||
[3]: https://www.linkedin.com/company/network-world
|
||||
Loading…
Reference in New Issue
Block a user