هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.
$ مستخدم عادي# بصلاحية root (أو مع sudo)
المهارات في هذا الفصل
- ضبط صلاحيات الملفات ومالكيها
Read the permission string
ls -l shows 10 characters: the type and three groups of rwx for the owner, the group and others.
ls -l /etc/shadow /usr/bin/passwd ~/report.txt
----------. 1 root root 1234 Oct 27 09:10 /etc/shadow
-rwsr-xr-x. 1 root root 32648 Jun 10 10:00 /usr/bin/passwd
-rw-r-----. 1 student finance 512 Oct 27 10:03 /home/student/report.txt- rw- r-- ---
│ │ │ └── others (o): everybody else
│ │ └─────── group (g): members of the group "finance"
│ └──────────── owner (u): the user "student"
└──────────────── type: - file, d folder, l linkLinux checks in this order: are you the owner? Then only the owner rights count. Else, are you in the group? Then the group rights count. Else the others rights count.
Know what r, w and x do
The same letters mean different things on a file and on a folder.
| Right | On a file | On a folder |
|---|---|---|
r read (4) | Read the content | List the names in it (ls) |
w write (2) | Change the content | Create, rename and delete files in it |
x execute (1) | Run it as a program or script | Go into it (cd) and reach files inside |
انتبه
Who may delete a file depends on the folder rights, not on the file. With w on a folder you can delete a file of root in it — unless the sticky bit is set (see below).
تذكّر
A folder almost always needs x together with r. r without x shows names, but you can not open anything.
Change rights with numbers
Add the values r=4, w=2, x=1 for each of owner, group and others. Three digits set all rights at once.
| Number | Rights | Typical use |
|---|---|---|
644 | rw-r--r-- | Normal file |
600 | rw------- | Private file (SSH keys, secrets) |
755 | rwxr-xr-x | Program, script, public folder |
750 | rwxr-x--- | Team folder or team script |
700 | rwx------ | Private folder (~/.ssh) |
640 | rw-r----- | Config file the service group may read |
Change rights with letters
The letter form changes only the rights you name: who (u g o a) + how (+ - =) + what (r w x).
chmod u+x deploy.sh
chmod g+w shared.txt
chmod o-rwx private.txt
chmod go= secret.txt
chmod a+r README
chmod u=rwx,g=rx,o= tool.sh
chmod -R g+rX /srv/docsفي العمل
X (capital) gives execute only to folders (and to files that already have it). chmod -R g+rX makes a tree readable without making every file a program.
Change the owner and the group
chown changes the owner (and the group), chgrp only the group. Only root can give a file to another user.
chown anna report.txt
chown anna:finance report.txt
chown :finance report.txt
chgrp finance report.txt
chown -R apache:apache /var/www/html/app
ls -l report.txt
-rw-r-----. 1 anna finance 512 Oct 27 10:03 report.txtانتبه
chown -R on the wrong path (for example / instead of ./) breaks the whole system. Check the path two times.
Set default rights with umask
New files start with 666 and new folders with 777. The umask takes rights away. With umask 022 you get files 644 and folders 755.
umask
0022
touch a.txt ; mkdir b
ls -ld a.txt b
-rw-r--r--. 1 student student 0 Oct 27 11:00 a.txt
drwxr-xr-x. 2 student student 6 Oct 27 11:00 b
umask 027
touch c.txt ; ls -l c.txt
-rw-r-----. 1 student student 0 Oct 27 11:01 c.txt| umask | New files | New folders |
|---|---|---|
022 | 644 | 755 |
002 | 664 | 775 |
027 | 640 | 750 |
077 | 600 | 700 |
umask NNN works only in the current shell. To keep it, put it in ~/.bashrc (one user) or a file in /etc/profile.d/ (all users).
Use the special rights
Three special rights solve special problems: SUID, SGID and the sticky bit.
| Right | Number | On a file | On a folder |
|---|---|---|---|
SUID (u+s) | 4000 | Runs with the rights of the owner (example: passwd) | — |
SGID (g+s) | 2000 | Runs with the rights of the group | New files get the group of the folder |
Sticky (o+t) | 1000 | — | Users can delete only their own files (example: /tmp) |
انتبه
Every SUID-root program is a possible way to become root. Check the list from time to time; a new unknown SUID file is a warning sign.