UNIX System Permissions and User Terminology
CSCI 330
The UNIX System
Unit V
Permissions
Permissions
•
all access to directories and files is controlled
•
UNIX uses discretionary access control (DAC) model
•
each directory/file has owner
•
owner has discretion over access control details
•
access control includes
•
read, write: to protect information
•
execute: to protect state of system
•
exception: super user
2
CSCI 330 – UNIX and Network Programming
User Terminology
•
user
•
any one who has account on the system, listed in /etc/passwd
•
protected via password, listed in /etc/shadow
•
internally recognized via a number called “user id”
•
group
•
users are organized into groups, listed /etc/group
•
user can belong to multiple groups
•
super user, root
•
has user id “0”
•
responsible for system administration
3
CSCI 330 – UNIX and Network Programming
File/Directory access
•
file or directory has owner, i.e. the user who created it
•
owner sets access permissions
•
access mode: read, write, execute
•
accessor category: self, group, others
•
ownership change via: chown
4
CSCI 330 – UNIX and Network Programming
Access Permission Modes
5
CSCI 330 – UNIX and Network Programming
Categories of Users
•
3 categories of users want access
6
CSCI 330 – UNIX and Network Programming
Checking Permissions
•
To check the permissions of an existing file or an existing
directory, use the “ls -l” command:
Example:
% ls -l
drwx------ 1 z036473 student 86 Feb 7 19:22 scripts
-rw-rw-r-- 1 z036473 student 20 Feb 9 11:25 out.txt
-rwxr-xr-- 1 z036473 student 34 Feb 3 19:42 checkIt
-rw-r--r-- 1 z036473 student 34 Feb 5 9:05 a2.png
7
CSCI 330 – UNIX and Network Programming
Change Permissions with chmod
8
CSCI 330 – UNIX and Network Programming
Changing Permissions: Symbolic Mode
9
u
f
o
r
u
s
e
r
g
f
o
r
g
r
o
u
p
o
f
o
r
o
t
h
e
r
s
a
f
o
r
a
l
l
+
f
o
r
a
d
d
-
f
o
r
r
e
m
o
v
e
=
f
o
r
a
s
s
i
g
n
r
f
o
r
r
e
a
d
w
f
o
r
w
r
i
t
e
x
f
o
r
e
x
e
c
u
t
e
CSCI 330 – UNIX and Network Programming
Examples: Symbolic Mode
% chmod u-w file.txt
% chmod u+w file.txt
% chmod u+x script.sh
% chmod g-w file.txt
% chmod o-rw file.txt
% chmod ug=rwx play.cc
% chmod a+wx other.html
% chmod u+x,go=r script.sh
10
10
CSCI 330 – UNIX and Network Programming
Changing Permissions: Octal Mode
11
11
CSCI 330 – UNIX and Network Programming
Changing Permissions: Octal Mode
% ls -l sort.c
-rwxr-xr-x 1 ege csci 80 Feb 27 12:23 sort.c
12
12
rwx
|
r-x
|
r-x
111
|
101
|
101
421
|
401
|
401
7
|
5
|
5
chmod 755 sort.c
CSCI 330 – UNIX and Network Programming
Changing Permissions: example
•
Goal: set mode of file “myfile”
•
Read, write, and execute permissions to self/owner
•
Read and execute permissions to group
•
Execute only permission to others
•
We want:
rwx r-x --x
Symbolic Mode:
chmod u=rwx,g=rx,o=x myfile
Octal Mode:
chmod 751 myfile
13
13
CSCI 330 – UNIX and Network Programming
Special Permissions
•
The regular file permissions (rwx) are used to assign
security to files and directories
•
3 additional special permissions can be optionally used on
files and directories
•
Set User Id (SUID)
•
Set Group ID (SGID)
•
Sticky bit
14
14
CSCI 330 – UNIX and Network Programming
Special Permissions: SUID
•
SUID used for executable files
•
makes executable run with privileges of file owner, rather than invoker
•
Example:
•
“passwd” command and file “/usr/bin/passwd”
-rwsr-xr-x 1 root root 41284 Apr 8 21:40 /usr/bin/passwd
•
allows regular user access to otherwise protected system
files while changing password
15
15
CSCI 330 – UNIX and Network Programming
Special Permissions: SGID
•
used for executable files
•
logic is similar to SUID bit
•
runs program with group permission of file, rather than group of
invoker
•
Example:
if a file is owned by the system group and also has the SGID bit
set, then if file is executed it runs with system group privileges
16
16
CSCI 330 – UNIX and Network Programming
SGID
Several file systems, including ext2/3/4, have the feature that when the SGID bit is set on a
directory, then a file created in that directory will be owned by the group owner of the directory,
not the group of the process that created the file.
This is invaluable for shared directories for group projects where users may belong to multiple
working groups. The directory for the group is created with proper group ownership and the
SGID bit set. From that point on files created in there will belong to the group.
Without the SGID bit set, what usually happens is that user A (who belongs to several groups)
will place a file in the common directory. It will belong to their default group, which may or may
not be the group of the project. User B comes along and can see the file in the directory, but
can't modify it due to group ownership issues. Unless all users explicitly change the group
ownership of files they create or change their default group association before working on the
project, frustration ensues.
By itself, SGID on directories doesn't solve everything. (All users need a default umask of 002
instead of 022 as well.) But it goes a long way to making systems governed by projects with
multiple users on multiple projects run a lot smoother.
17
17
CSCI 330 – UNIX and Network Programming
Special Permissions: Sticky Bit
•
not clearly defined
•
for executable files:
•
executable is kept in memory even after it ended
(no longer used, since modern virtual memory
methods are more advanced)
•
for directories:
•
file can only be deleted by the user that created it
18
18
CSCI 330 – UNIX and Network Programming
Special Permissions: display
•
“ls -l” command does not have a section for special
permission bits
•
however, since special permissions required “execute”,
they mask the execute permission when displayed using
the “ls -l” command.
19
19
CSCI 330 – UNIX and Network Programming
Setting Special Permissions
Use the “chmod” command with octal mode:
•
chmod 7777 filename
20
20
CSCI 330 – UNIX and Network Programming
Setting Special Permissions
•
chmod with symbolic notation:
u+s
add SUID
u-s
remove SUID
g+s
add SGID
g-s
remove SGID
+s
add SUID and SGID
+t
set sticky bit
21
21
CSCI 330 – UNIX and Network Programming
File mode creation mask
•
umask (user mask)
•
governs default permission for files and directories
•
sequence of 9 bits: 3 times 3 bits of rwx
•
default:
000 010 010
(022)
•
in octal form its bits are removed from:
•
for a file:
110 110 110
(666)
•
for a directory:
111 111 111
(777)
•
permission for new
•
file:
110 100 100
(644)
•
directory:
111 101 101
(755)
22
22
CSCI 330 – UNIX and Network Programming
User Mask value examples
23
23
CSCI 330 – UNIX and Network Programming
default
Change the permission default
•
command to display: umask
•
uses a leading zero
•
0022
•
umask -S
•
u=rwx,g=rx,o=rx
•
command to change: umask
•
tolerates leading zero
•
ex:
% umask 0077
% umask a-r
24
24
CSCI 330 – UNIX and Network Programming
Summary
•
r, w, x
•
and extra bits (s,t)
•
user (self, owner), group, others
•
file mode creation mask: umask
25
25
CSCI 330 – UNIX and Network Programming
CSCI 330 - The UNIX System
NIU - Department of Computer Science
Explore the concept of UNIX system permissions, including discretionary access control (DAC) model, user terminology, file/directory access, access permission modes, categories of users, and checking permissions using examples. Learn about user IDs, groups, superuser privileges, ownership, access modes, and more in the UNIX environment.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
CSCI 330 The UNIX System Unit V Permissions
CSCI 330 UNIX and Network Programming 2 Permissions all access to directories and files is controlled UNIX uses discretionary access control (DAC) model each directory/file has owner owner has discretion over access control details access control includes read, write: to protect information execute: to protect state of system exception: super user
CSCI 330 UNIX and Network Programming 3 User Terminology user any one who has account on the system, listed in /etc/passwd protected via password, listed in /etc/shadow internally recognized via a number called user id group users are organized into groups, listed /etc/group user can belong to multiple groups super user, root has user id 0 responsible for system administration
CSCI 330 UNIX and Network Programming 4 File/Directory access file or directory has owner, i.e. the user who created it owner sets access permissions access mode: read, write, execute accessor category: self, group, others ownership change via: chown
CSCI 330 UNIX and Network Programming 5 Access Permission Modes Meaning on File Meaning on Directory r (read) View file contents (open, read) List directory contents w (write) Change file contents Change directory contents x (execute) Run executable file Make it current directory, search for files in it
CSCI 330 UNIX and Network Programming 6 Categories of Users 3 categories of users want access
CSCI 330 UNIX and Network Programming 7 Checking Permissions To check the permissions of an existing file or an existing directory, use the ls -l command: Example: % ls -l drwx------ 1 z036473 student 86 Feb 7 19:22 scripts -rw-rw-r-- 1 z036473 student 20 Feb 9 11:25 out.txt -rwxr-xr-- 1 z036473 student 34 Feb 3 19:42 checkIt -rw-r--r-- 1 z036473 student 34 Feb 5 9:05 a2.png
CSCI 330 UNIX and Network Programming 8 Change Permissions with chmod
CSCI 330 UNIX and Network Programming 9 Changing Permissions: Symbolic Mode r for read w for write x for execute + for add - for remove = for assign u for user g for group o for others a for all
CSCI 330 UNIX and Network Programming 10 Examples: Symbolic Mode % chmod u-w file.txt % chmod u+w file.txt % chmod u+x script.sh % chmod g-w file.txt % chmod o-rw file.txt % chmod ug=rwx play.cc % chmod a+wx other.html % chmod u+x,go=r script.sh
CSCI 330 UNIX and Network Programming 11 Changing Permissions: Octal Mode
CSCI 330 UNIX and Network Programming 12 Changing Permissions: Octal Mode Step Settings rwx|r-x|r-x 111|101|101 Perform List the desired setting 1 2 Assign binary: 1 for access; 0 for no access 421|401|401 7 | 5 | 5 chmod 755 sort.c 3 List octal values for the corresponding binary 1 s Convert the octal values to a 3-digit number Write the command 4 5 % ls -l sort.c -rwxr-xr-x 1 ege csci 80 Feb 27 12:23 sort.c
CSCI 330 UNIX and Network Programming 13 Changing Permissions: example Goal: set mode of file myfile Read, write, and execute permissions to self/owner Read and execute permissions to group Execute only permission to others We want: Symbolic Mode: chmod u=rwx,g=rx,o=x myfile Octal Mode: chmod 751 myfile rwx r-x --x
CSCI 330 UNIX and Network Programming 14 Special Permissions The regular file permissions (rwx) are used to assign security to files and directories 3 additional special permissions can be optionally used on files and directories Set User Id (SUID) Set Group ID (SGID) Sticky bit
CSCI 330 UNIX and Network Programming 15 Special Permissions: SUID SUID used for executable files makes executable run with privileges of file owner, rather than invoker Example: passwd command and file /usr/bin/passwd -rwsr-xr-x 1 root root 41284 Apr 8 21:40 /usr/bin/passwd allows regular user access to otherwise protected system files while changing password
CSCI 330 UNIX and Network Programming 16 Special Permissions: SGID used for executable files logic is similar to SUID bit runs program with group permission of file, rather than group of invoker Example: if a file is owned by the system group and also has the SGID bit set, then if file is executed it runs with system group privileges
CSCI 330 UNIX and Network Programming 18 Special Permissions: Sticky Bit not clearly defined for executable files: executable is kept in memory even after it ended (no longer used, since modern virtual memory methods are more advanced) for directories: file can only be deleted by the user that created it
CSCI 330 UNIX and Network Programming 19 Special Permissions: display ls -l command does not have a section for special permission bits however, since special permissions required execute , they mask the execute permission when displayed using the ls -l command. r w x r w x r w x r w s r w s r w t SGID STICKY BIT SUID
CSCI 330 UNIX and Network Programming 20 Setting Special Permissions suid sgid stb r w x r w x r w x 4 2 1 4 2 1 4 2 1 4 2 1 7 7 7 7 Special user group others Use the chmod command with octal mode: chmod 7777 filename
CSCI 330 UNIX and Network Programming 21 Setting Special Permissions chmod with symbolic notation: u+s u-s add SUID remove SUID g+s g-s add SGID remove SGID +s +t add SUID and SGID set sticky bit
CSCI 330 UNIX and Network Programming 22 File mode creation mask umask (user mask) governs default permission for files and directories sequence of 9 bits: 3 times 3 bits of rwx default: 000 010 010 in octal form its bits are removed from: for a file: 110 110 110 for a directory: 111 111 111 permission for new file: 110 100 100 directory: 111 101 101 (022) (666) (777) (644) (755)
CSCI 330 UNIX and Network Programming 23 User Mask value examples Directory Default: 777 777 (rwx rwx rwx) File Default: 666 666 (rw- rw- rw-) 000 111 666 (rw- rw- rw-) 666 (rw- rw- rw-) 222 555 (r-x r-x r-x) 444 (r-- r-- r--) 022 755 (rwx r-x r-x) 644 (rw- r-- r--) default 002 775 (rwx rwx r-x) 664 (rw- rw- r--) 066 711 (rwx --x --x) 600 (rw- --- ---) 666 111 (--x --x --x) 000 (--- --- --- ) 777 000 (--- --- --- ) 000 (--- --- --- )
CSCI 330 UNIX and Network Programming 24 Change the permission default command to display: umask uses a leading zero 0022 umask -S u=rwx,g=rx,o=rx command to change: umask tolerates leading zero ex: % umask 0077 % umask a-r
CSCI 330 UNIX and Network Programming 25 Summary r, w, x and extra bits (s,t) user (self, owner), group, others file mode creation mask: umask
