07-29-2019, 02:19 PM
Command line quick tips: More about permissions
<div><p>A previous article <a href="https://fedoramagazine.org/command-line-quick-tips-permissions/">covered some basics about file permissions</a> on your Fedora system. This installment shows you additional ways to use permissions to manage file access and sharing. It also builds on the knowledge and examples in the previous article, so if you haven’t read that one, do <a href="https://fedoramagazine.org/command-line-quick-tips-permissions/">check it out</a>.</p>
<p> <span id="more-29000"></span> </p>
<h2>Symbolic and octal</h2>
<p>In the previous article you saw how there are three distinct permission sets for a file. The user that owns the file has a set, members of the group that owns the file has a set, and then a final set is for everyone else. These permissions are expressed on screen in a long listing (<em>ls -l</em>) using symbolic mode.</p>
<p>Each set has <strong>r, w,</strong> and <strong>x</strong> entries for whether a particular user (owner, group member, or other) can read, write, or execute that file. But there’s another way to express these permissions: in <strong>octal</strong> mode.</p>
<p>You’re used to the <a href="https://en.wikipedia.org/wiki/Decimal">decimal</a> numbering system, which has ten distinct values (0 through 9). The octal system, on the other hand, has eight distinct values (0 through 7). In the case of permissions, octal is used as a shorthand to show the value of the <strong>r, w,</strong> and <strong>x</strong> fields. Think of each field as having a value:</p>
<ul>
<li><strong>r</strong> = 4</li>
<li><strong>w</strong> = 2</li>
<li><strong>x</strong> = 1</li>
</ul>
<p>Now you can express any combination with a single octal value. For instance, read and write permission, but no execute permission, would have a value of 6. Read and execute permission only would have a value of 5. A file’s <strong>rwxr-xr-x</strong> symbolic permission has an octal value of <strong>755</strong>.</p>
<p>You can use octal values to set file permissions with the <em>chmod</em> command similarly to symbolic values. The following two commands set the same permissions on a file:</p>
<pre class="wp-block-preformatted">chmod u=rw,g=r,o=r myfile1<br />chmod 644 myfile1</pre>
<h2>Special permission bits</h2>
<p>There are several special permission bits also available on a file. These are called <strong>setuid</strong> (or <strong>suid</strong>), <strong>setgid</strong> (or <strong>sgid</strong>), and the <strong>sticky bit</strong> (or <strong>delete inhibit</strong>). Think of this as yet another set of octal values:</p>
<ul>
<li>setuid = 4</li>
<li>setgid = 2</li>
<li>sticky = 1</li>
</ul>
<p>The <strong>setuid</strong> bit is ignored <em>unless</em> the file is executable. If that’s the case, the file (presumably an app or a script) runs as if it were launched by the user who owns the file. A good example of setuid is the <em>/bin/passwd</em> utility, which allows a user to set or change passwords. This utility must be able to write to files no user should be allowed to change. Therefore it is carefully written, owned by the <em>root</em> user, and has a setuid bit so it can alter the password related files.</p>
<p>The <strong>setgid</strong> bit works similarly for executable files. The file will run with the permissions of the group that owns it. However, setgid also has an additional use for directories. If a file is created in a directory with setgid permission, the group owner for the file will be set to the group owner of the directory.</p>
<p>Finally, the sticky bit, while ignored for files, is useful for directories. The sticky bit set on a directory will prevent a user from deleting files in that directory owned by other users.</p>
<p>The way to set these bits with <em>chmod</em> in octal mode is to add a value prefix, such as <strong>4755</strong> to add setuid to an executable file. In symbolic mode, the <strong>u</strong> and <strong>g</strong> can be used to set or remove setuid and setgid, such as <strong>u+s,g+s</strong>. The sticky bit is set using <strong>o+t</strong>. (Other combinations, like <strong>o+s</strong> or <strong>u+t</strong>, are meaningless and ignored.)</p>
<h2>Sharing and special permissions</h2>
<p>Recall the example from the previous article concerning a finance team that needs to share files. As you can imagine, the special permission bits help to solve their problem even more effectively. The original solution simply made a directory the whole group could write to:</p>
<pre class="wp-block-preformatted">drwxrwx---. 2 root finance 4096 Jul 6 15:35 finance<br /></pre>
<p>One problem with this directory is that users <em>dwayne</em> and <em>jill</em>, who are both members of the <em>finance</em> group, can delete each other’s files. That’s not optimal for a shared space. It might be useful in some situations, but probably not when dealing with financial records!</p>
<p>Another problem is that files in this directory may not be truly shared, because they will be owned by the default groups of <em>dwayne</em> and <em>jill</em> — most likely the user private groups also named <em>dwayne</em> and <em>jill</em>.</p>
<p>A better way to solve this is to set both setgid and the sticky bit on the folder. This will do two things — cause files created in the folder to be owned by the <em>finance</em> group automatically, and prevent <em>dwayne</em> and <em>jill</em> from deleting each other’s files. Either of these commands will work:</p>
<pre class="wp-block-preformatted">sudo chmod 3770 finance<br />sudo chmod u+rwx,g+rwxs,o+t finance</pre>
<p>The long listing for the file now shows the new special permissions applied. The sticky bit appears as <strong>T</strong> and not <strong>t</strong> because the folder is not searchable for users outside the <em>finance</em> group.</p>
<pre class="wp-block-preformatted">drwxrws--T. 2 root finance 4096 Jul 6 15:35 finance</pre></p>
</div>
<div><p>A previous article <a href="https://fedoramagazine.org/command-line-quick-tips-permissions/">covered some basics about file permissions</a> on your Fedora system. This installment shows you additional ways to use permissions to manage file access and sharing. It also builds on the knowledge and examples in the previous article, so if you haven’t read that one, do <a href="https://fedoramagazine.org/command-line-quick-tips-permissions/">check it out</a>.</p>
<p> <span id="more-29000"></span> </p>
<h2>Symbolic and octal</h2>
<p>In the previous article you saw how there are three distinct permission sets for a file. The user that owns the file has a set, members of the group that owns the file has a set, and then a final set is for everyone else. These permissions are expressed on screen in a long listing (<em>ls -l</em>) using symbolic mode.</p>
<p>Each set has <strong>r, w,</strong> and <strong>x</strong> entries for whether a particular user (owner, group member, or other) can read, write, or execute that file. But there’s another way to express these permissions: in <strong>octal</strong> mode.</p>
<p>You’re used to the <a href="https://en.wikipedia.org/wiki/Decimal">decimal</a> numbering system, which has ten distinct values (0 through 9). The octal system, on the other hand, has eight distinct values (0 through 7). In the case of permissions, octal is used as a shorthand to show the value of the <strong>r, w,</strong> and <strong>x</strong> fields. Think of each field as having a value:</p>
<ul>
<li><strong>r</strong> = 4</li>
<li><strong>w</strong> = 2</li>
<li><strong>x</strong> = 1</li>
</ul>
<p>Now you can express any combination with a single octal value. For instance, read and write permission, but no execute permission, would have a value of 6. Read and execute permission only would have a value of 5. A file’s <strong>rwxr-xr-x</strong> symbolic permission has an octal value of <strong>755</strong>.</p>
<p>You can use octal values to set file permissions with the <em>chmod</em> command similarly to symbolic values. The following two commands set the same permissions on a file:</p>
<pre class="wp-block-preformatted">chmod u=rw,g=r,o=r myfile1<br />chmod 644 myfile1</pre>
<h2>Special permission bits</h2>
<p>There are several special permission bits also available on a file. These are called <strong>setuid</strong> (or <strong>suid</strong>), <strong>setgid</strong> (or <strong>sgid</strong>), and the <strong>sticky bit</strong> (or <strong>delete inhibit</strong>). Think of this as yet another set of octal values:</p>
<ul>
<li>setuid = 4</li>
<li>setgid = 2</li>
<li>sticky = 1</li>
</ul>
<p>The <strong>setuid</strong> bit is ignored <em>unless</em> the file is executable. If that’s the case, the file (presumably an app or a script) runs as if it were launched by the user who owns the file. A good example of setuid is the <em>/bin/passwd</em> utility, which allows a user to set or change passwords. This utility must be able to write to files no user should be allowed to change. Therefore it is carefully written, owned by the <em>root</em> user, and has a setuid bit so it can alter the password related files.</p>
<p>The <strong>setgid</strong> bit works similarly for executable files. The file will run with the permissions of the group that owns it. However, setgid also has an additional use for directories. If a file is created in a directory with setgid permission, the group owner for the file will be set to the group owner of the directory.</p>
<p>Finally, the sticky bit, while ignored for files, is useful for directories. The sticky bit set on a directory will prevent a user from deleting files in that directory owned by other users.</p>
<p>The way to set these bits with <em>chmod</em> in octal mode is to add a value prefix, such as <strong>4755</strong> to add setuid to an executable file. In symbolic mode, the <strong>u</strong> and <strong>g</strong> can be used to set or remove setuid and setgid, such as <strong>u+s,g+s</strong>. The sticky bit is set using <strong>o+t</strong>. (Other combinations, like <strong>o+s</strong> or <strong>u+t</strong>, are meaningless and ignored.)</p>
<h2>Sharing and special permissions</h2>
<p>Recall the example from the previous article concerning a finance team that needs to share files. As you can imagine, the special permission bits help to solve their problem even more effectively. The original solution simply made a directory the whole group could write to:</p>
<pre class="wp-block-preformatted">drwxrwx---. 2 root finance 4096 Jul 6 15:35 finance<br /></pre>
<p>One problem with this directory is that users <em>dwayne</em> and <em>jill</em>, who are both members of the <em>finance</em> group, can delete each other’s files. That’s not optimal for a shared space. It might be useful in some situations, but probably not when dealing with financial records!</p>
<p>Another problem is that files in this directory may not be truly shared, because they will be owned by the default groups of <em>dwayne</em> and <em>jill</em> — most likely the user private groups also named <em>dwayne</em> and <em>jill</em>.</p>
<p>A better way to solve this is to set both setgid and the sticky bit on the folder. This will do two things — cause files created in the folder to be owned by the <em>finance</em> group automatically, and prevent <em>dwayne</em> and <em>jill</em> from deleting each other’s files. Either of these commands will work:</p>
<pre class="wp-block-preformatted">sudo chmod 3770 finance<br />sudo chmod u+rwx,g+rwxs,o+t finance</pre>
<p>The long listing for the file now shows the new special permissions applied. The sticky bit appears as <strong>T</strong> and not <strong>t</strong> because the folder is not searchable for users outside the <em>finance</em> group.</p>
<pre class="wp-block-preformatted">drwxrws--T. 2 root finance 4096 Jul 6 15:35 finance</pre></p>
</div>