File Permissions and Access Rights 2

File Permissions and Access Rights 2

Special Access Rights Setuid and Setgid

To allow a user who is not authorized to access a file to temporarily access the file, the setuid and setgid programs are authorized to execute the programs. Setuid works with the authority of the user who owns the program for the duration of the program. A program marked with setgid works with the authority of the group that owns it for the duration of the program.

To give setuid access: "chmod u+s file_name"
To give setgid access: "chmod g+s file_name"

The "setuid" and "setgid" private study authorities apply only to compiled program files. The setuid or setgid run permission for a shell program is not different from the normal run permission.

Sticky "t" is a special case for the privileged directories. A directory with the "t" privilege can be written by all users, but can not be deleted or updated other users' writes (unless they are given write permissions on a file basis). However, a directory with an access rights of "rwxrwxrwx" is writable by everyone and they can also delete others' files.



It would not have been possible for ordinary users to change their passwords stored in /etc/passwd and /etc/shadow without the setuid scheme. Since the information stored in these files can only be accessed by the root user, the passwd program is setuid as root.

As it can be seen in the example above owner of the /etc/passwd file is the root user. However binary file located at /usr/bin/passwd has the setuid access right which means anyone can execute this file with the root authority.

For security reasons, setuid/setgid should not be done despite all these benefits, unless it is needed.

Sticky 't' Right

Sticky bit prevents other users to delete a file created by another user in the temporary file writing directories required by all user programs. In such directories, no user can delete another user's file or directory through sticky special authority, even though the user, group and others have all the permissions (read, write, execute). A temporary file created by a user in a directory such as "/tmp" without the "Sticky" special authority could easily be deleted by another user for the reason that all the permissions were granted to everyone else.

Setuid, setgid and sticky bit is set just like regular file permissions. For setuid we use 4, for setgid we use 2 and for sticky bit we use 1. For example:

All rights are given to a file including setuid, setgid and sticky bit:
chmod 7777 example_file

A file is given read permission to owner and group only and has sticky bit:
chmod 1440 example_file

Changing Owner and Group of a File/Directory

"chown" command is used for changing the owner of a file or directory and "chgrp" command is used for changing the group of a file or directory.


If the "chown" or "chgrp" command is used with the "-R" option, the entire directory and filename under the command directory will be applied if the given parameter is an directory. If the "-R" option is not given, the command is applied only to the directory/file given as parameter.

chown -R newOwner:newGroup directory_name: This command sets newOwner and newGroup as the owner and group of every file and directory under directory_name recursively.

Ordinary users can not use the "chown" command. If they change ownership of a file of their own, they lose their authority over the file and can not take ownership of the file without the help of "root". The "chown" command can not be used by ordinary users to prevent this, whereas ordinary users have limited use of the "chgrp" command.

To read my previous article: File Permissions and Access Rights 1

File Permissions and Access Rights 1

File Permissions and Access Rights 1

File and Directory Access Reviews

In UNIX, all kinds of system resources have the rights to read, write and execute on defined users and groups. The file attributes configuration determines who can read, write, and execute a resource.
 
By default, a user has all rights to all resources under his or her home directory.

A special UNIX user, 'root', has all rights over all system resources.

Above "ls -l" is shown where the owner of the file, the group, and the access authorities are located.

The first character on the left is the file type ("-" ordinary file, "l" link, "d" directory, etc.)

The next 3 characters are the access authority of the owner of the file
The following 3 characters are the access authority of the group of the file
The last 3 characters are the access authorities of the others
 
The * mark on the right side of the file names indicates that the file is executable by the current user. This is a feature of the ls program running under Linux.

As can be understood from the examples, there are three kinds of authority, and these authorities read, write and operate with the order.

If there is a letter in the authorization definition, the corresponding authorization is given. If there is a "-" sign, the authorization is not given.

When three of these definitions of authority come side by side, the authority of the owner, group and others of the file can be determined.

For example:"---------" means that no one has any authority"r --------" means that the owner only has the authority to read, the same group and others have no authority over the file"rw-rw-r--" means that the owner and the group have the authority to read and write, and others are only authorized to read"rwx-r-xr-x" indicates that the owner has read, write and execute authority, the group has authority to read and execute the group, and others have read and execute authority.

The writing authority defines the ability to make changes and delete at the same time. The person who is authorized to write to a file can be deleted.

Access to files and directories is regulated by the "chmod" command.

"chmod u+x hidden_file" - gives the right to run the "hidden_file" file. 

"chmod ug = rw important_file" - only the read and write authority is given to the owner and group of the "important_file" file, and the authority of the other does not change.

Multiple authorizations can be made at the same time, separated by commas.

"chmod ug+rw, ug-x, o-rwx bigfile" - the owner and group of the "bigfile" file are given read and write permissions, the owner of the file and its group are authorized to run, and no authority is given to the others.

The special powers of stick, setuid and setgid will be discussed later.

The access authority of the file can be given in octal numbers for chmod command.

You need to use 4 for "r", 2 for "w", 1 for "x" and finally 0 for "-". The figures corresponding to the authorities are written and collected in groups of 3. The 3-digit number is the number of authority.

For example:

"-rw-r-x---"        means (4+2+0) + (4+0+1) + (0+0+0) = 650
"-rwx-wx--x"     means (4+2+1) + (0+2+1) + (0+0+1) = 731
"-rwxrwxrwx"  means (4+2+1) + (4+2+1) + (4+2+1) = 777

We can change the access rights of any file by both following ways (they both mean the same):

chmod +rwx any_file.ext
chmod 777 any_file.ext

The permissions will be "-rwxrwxrwx".

To read my previous article: File and Directory Commands