{"id":2798,"date":"2022-02-19T22:16:34","date_gmt":"2022-02-19T22:16:34","guid":{"rendered":"https:\/\/dft.wiki\/?p=2798"},"modified":"2022-05-19T03:58:39","modified_gmt":"2022-05-19T03:58:39","slug":"file-permissions-and-proprieties-in-linux","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=2798","title":{"rendered":"File Permissions and Proprieties in Linux"},"content":{"rendered":"

File (and directory) permissions<\/strong> in Linux and Unix-based systems define what the owner, the group and the others can or can not do with it.<\/p>\n

Execute the following command in any directory that contains files and or directories (the command stat<\/code> can give even more information):<\/p>\n

ls -l<\/pre>\n
It might print an output that resembles the following:<\/p>\n
-rw-r--r--<\/strong> 1 owner owner  310  Oct 31 16:32 fileName\r\ndrwxr-xr-x<\/strong> 2 owner group 4096  Apr 26 2021  directoryName<\/pre>\n
Each line starts with a series of 10 consecutive characters.<\/p>\n
Except for the first character<\/strong>, the others can be:<\/p>\n
    \n
  • r<\/strong>\n
      \n
    • Reading access<\/li>\n<\/ul>\n<\/li>\n
    • w<\/strong>\n
        \n
      • Writing access<\/li>\n<\/ul>\n<\/li>\n
      • x<\/strong>\n
          \n
        • Executing access<\/li>\n<\/ul>\n<\/li>\n
        • –<\/strong>\n
            \n
          • No access<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
            They are grouped as:<\/p>\n
              \n
            • -uuu——\n
                \n
              • Privileges of the user that owns the file<\/li>\n<\/ul>\n<\/li>\n
              • —-ggg—\n
                  \n
                • Privileges of the group that owns the file<\/li>\n<\/ul>\n<\/li>\n
                • ——-ooo\n
                    \n
                  • Privileges of any other user<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                    Example:<\/p>\n
                      \n
                    • -rwx–xr–\n
                        \n
                      • The owner can Read Write and Execute<\/li>\n
                      • The group can only Execute<\/li>\n
                      • The others can only Read<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                        Exclusively the first character<\/strong> can be:<\/p>\n
                          \n
                        • –<\/strong>\n
                            \n
                          • Regular file.<\/li>\n<\/ul>\n<\/li>\n
                          • b<\/strong>\n
                              \n
                            • Block special file.<\/li>\n<\/ul>\n<\/li>\n
                            • c<\/strong>\n
                                \n
                              • Character special file.<\/li>\n<\/ul>\n<\/li>\n
                              • d<\/strong>\n
                                  \n
                                • Directory<\/li>\n<\/ul>\n<\/li>\n
                                • l<\/strong>\n
                                    \n
                                  • Symbolic link.<\/li>\n<\/ul>\n<\/li>\n
                                  • p<\/strong>\n
                                      \n
                                    • FIFO<\/li>\n<\/ul>\n<\/li>\n
                                    • s<\/strong>\n
                                        \n
                                      • Socket<\/li>\n<\/ul>\n<\/li>\n
                                      • w<\/strong>\n
                                          \n
                                        • Whiteout<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                          What the file is cannot be changed but it is important to know how to identify when it is a directory and a symbolic link. All the others are special usages.<\/p>\n
                                          \n
                                          Another notation for representing file privileges is using 3 digit numbers where:<\/p>\n
                                            \n
                                          • 4 = Read<\/li>\n
                                          • 2 = Write<\/li>\n
                                          • 1 = Execute<\/li>\n<\/ul>\n
                                            And they can be combined to provide multiple privileges:<\/p>\n
                                              \n
                                            • 0 = No access<\/li>\n
                                            • 3 = Write + Execute<\/li>\n
                                            • 5 = Read + Execute<\/li>\n
                                            • 6 = Read + Write<\/li>\n
                                            • 7 = Read + Write + Execute<\/li>\n<\/ul>\n
                                              Example:<\/p>\n
                                                \n
                                              • 750\n
                                                  \n
                                                • The owner can Read, Write, and Execute.<\/li>\n
                                                • The group can Read and Execute.<\/li>\n
                                                • Others have no access at all.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                  \n
                                                  System administrators use the command chmod<\/code> to change the permission in the files:<\/p>\n
                                                    \n
                                                  • chmod +x fileName\n
                                                      \n
                                                    • Allow owner, group, and others to execute access.<\/li>\n<\/ul>\n<\/li>\n
                                                    • chmod -w fileName\n
                                                        \n
                                                      • Disallow owner, group, and others to write access.<\/li>\n<\/ul>\n<\/li>\n
                                                      • chmod g=r fileName\n
                                                          \n
                                                        • Allow the group to only read, removing any other access it already has.<\/li>\n<\/ul>\n<\/li>\n
                                                        • chmod o+x -R fileName\n
                                                            \n
                                                          • Allow others to execute and preserve any other access it already has recursively.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                            Hint: use -v<\/code> for more verbose output.<\/p>\n
                                                            \n
                                                            The attributed define what can be done with the file, not who.<\/p>\n
                                                            List the attributes of a file or directory:<\/p>\n
                                                            lsattr<\/pre>\n
                                                            A series of 22 characters (----------------------<\/code>) inform all the attributes for each object in the current directory.<\/p>\n
                                                            The seven most important attributes are:<\/p>\n
                                                              \n
                                                            • A<\/strong>\n
                                                                \n
                                                              • Do not update access timestamp (atime<\/code>).<\/li>\n<\/ul>\n<\/li>\n
                                                              • S<\/strong>\n
                                                                  \n
                                                                • Changes are synchronously updates don’t the disk.<\/li>\n<\/ul>\n<\/li>\n
                                                                • a<\/strong>\n
                                                                    \n
                                                                  • The file’s content can only be appended, not modified.<\/li>\n<\/ul>\n<\/li>\n
                                                                  • i<\/strong>\n
                                                                      \n
                                                                    • The fIle becomes immutable, impossible to be modified.<\/li>\n<\/ul>\n<\/li>\n
                                                                    • j<\/strong>\n
                                                                        \n
                                                                      • The changes are updated in the ext3 journal prior to changing the file itself.<\/li>\n<\/ul>\n<\/li>\n
                                                                      • t<\/strong>\n
                                                                          \n
                                                                        • Do not allow tail-merging.<\/li>\n<\/ul>\n<\/li>\n
                                                                        • u<\/strong>\n
                                                                            \n
                                                                          • Then the fil is deleted its data is saved, allowing undeletion<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                            Use the chattr<\/code> command to change its attributes:<\/p>\n
                                                                              \n
                                                                            • sudo chattr +a fileName\n
                                                                                \n
                                                                              • Activating the attribute that only allows appending content.<\/li>\n<\/ul>\n<\/li>\n
                                                                              • sudo chattr -i -R fileName\n
                                                                                  \n
                                                                                • Deactivating the immutable attribute if active recursively<\/strong>.<\/li>\n<\/ul>\n<\/li>\n
                                                                                • sudo chattr =ua fileName\n
                                                                                    \n
                                                                                  • Activate only<\/strong> the listed attributes. All the others will be deactivated.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                    \n
                                                                                    SUID (Set-user Identification) & SGID (Set-group identification)<\/strong><\/p>\n
                                                                                    Whenever the either of the permission flags is set on an executable file it will provide the privileges of the file owner during the execution. In other words, if a regular user is allowed to execute a script that is owned by root, for example, it will be executed with root privileges.<\/p>\n
                                                                                      \n
                                                                                    • 2000\n
                                                                                        \n
                                                                                      • SGID is set.<\/li>\n<\/ul>\n<\/li>\n
                                                                                      • 4000\n
                                                                                          \n
                                                                                        • SUID is set.<\/li>\n<\/ul>\n<\/li>\n
                                                                                        • 6000\n
                                                                                            \n
                                                                                          • SGID + SUID are set.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                            Another notation is used in the comment that lists the files of an directory that will contain s<\/strong> replacing x<\/strong> as follows:<\/p>\n
                                                                                              \n
                                                                                            • —s<\/strong>——\n
                                                                                                \n
                                                                                              • SUID is set.<\/li>\n<\/ul>\n<\/li>\n
                                                                                              • ——s<\/strong>—\n
                                                                                                  \n
                                                                                                • SGID is set.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                                  Command to set SUID<\/p>\n
                                                                                                  chmod u+s fileName<\/pre>\n
                                                                                                  Command to unset SGID<\/p>\n
                                                                                                  chmod g-s fileName<\/pre>\n
                                                                                                  \n
                                                                                                  STICKY BIT<\/strong><\/p>\n
                                                                                                  It is primarily used on shared directories, where users can create new files, read and execute files owned by other users, but are not allowed to remove files owned by other users.<\/p>\n
                                                                                                    \n
                                                                                                  • 1000\n
                                                                                                      \n
                                                                                                    • Sticky bit set.<\/li>\n<\/ul>\n<\/li>\n
                                                                                                    • ———t<\/strong>\n
                                                                                                        \n
                                                                                                      • The x<\/strong> from others is replaced by a t<\/strong> when the bit is set.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                                                                                                        Command to set the sticky bit on a directory (or file):<\/p>\n
                                                                                                        chmod +t fileName<\/pre>\n
                                                                                                        \n
                                                                                                        BONUS<\/strong><\/p>\n
                                                                                                        For security reasons it is highly recommended to identify and unset the SUID and SGID of files. It can easily be abused.<\/p>\n
                                                                                                        Searching:<\/p>\n
                                                                                                        find \/ -perm \/2000\r\nfind \/ -perm \/4000\r\nfind \/ -user root -perm \/6000<\/pre>\n
                                                                                                        OR<\/p>\n
                                                                                                        find \/ -perm \/g+s\r\nfind \/ -perm \/u+s\r\nfind \/ -user root -perm \/u+s,g+s<\/pre>\n
                                                                                                        To search and unset on the fly:<\/p>\n
                                                                                                        for i in `find \/ -perm +2000` do chmod g-s $i done<\/pre>\n","protected":false},"excerpt":{"rendered":"
                                                                                                        File (and directory) permissions in Linux and Unix-based systems define what the owner, the group […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,6],"tags":[],"class_list":["post-2798","post","type-post","status-publish","format-standard","hentry","category-linux","category-raspberry-pi"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2798","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2798"}],"version-history":[{"count":5,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2798\/revisions"}],"predecessor-version":[{"id":2885,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2798\/revisions\/2885"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2798"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2798"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2798"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}