Control access to files

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Bestandsrechten en eigenaars instellen

Read the permission string

ls -l shows 10 characters: the type and three groups of rwx for the owner, the group and others.

$ls -l /etc/shadow /usr/bin/passwd ~/report.txt
----------. 1 root    root     1234 Oct 27 09:10 /etc/shadow
-rwsr-xr-x. 1 root    root    32648 Jun 10 10:00 /usr/bin/passwd
-rw-r-----. 1 student finance   512 Oct 27 10:03 /home/student/report.txt

-  rw-  r--  ---
│   │    │    └── others (o): everybody else
│   │    └─────── group  (g): members of the group "finance"
│   └──────────── owner  (u): the user "student"
└──────────────── type: - file, d folder, l link

Linux checks in this order: are you the owner? Then only the owner rights count. Else, are you in the group? Then the group rights count. Else the others rights count.

11.2

Know what r, w and x do

The same letters mean different things on a file and on a folder.

Right	On a file	On a folder
`r` read (4)	Read the content	List the names in it (`ls`)
`w` write (2)	Change the content	Create, rename and delete files in it
`x` execute (1)	Run it as a program or script	Go into it (`cd`) and reach files inside

Let op

Who may delete a file depends on the folder rights, not on the file. With w on a folder you can delete a file of root in it — unless the sticky bit is set (see below).

Onthoud

A folder almost always needs x together with r. r without x shows names, but you can not open anything.

11.3

Change rights with numbers

Add the values r=4, w=2, x=1 for each of owner, group and others. Three digits set all rights at once.

Number	Rights	Typical use
`644`	`rw-r--r--`	Normal file
`600`	`rw-------`	Private file (SSH keys, secrets)
`755`	`rwxr-xr-x`	Program, script, public folder
`750`	`rwxr-x---`	Team folder or team script
`700`	`rwx------`	Private folder (`~/.ssh`)
`640`	`rw-r-----`	Config file the service group may read

$chmod 644 index.html
$chmod 600 ~/.ssh/id_ed25519
$chmod 750 /srv/scripts/backup.sh
#chmod -R 750 /srv/finance

11.4

Change rights with letters

The letter form changes only the rights you name: who (u g o a) + how (+ - =) + what (r w x).

$chmod u+x deploy.sh
$chmod g+w shared.txt
$chmod o-rwx private.txt
$chmod go= secret.txt
$chmod a+r README
$chmod u=rwx,g=rx,o= tool.sh
#chmod -R g+rX /srv/docs

Op het werk

X (capital) gives execute only to folders (and to files that already have it). chmod -R g+rX makes a tree readable without making every file a program.

11.5

Change the owner and the group

chown changes the owner (and the group), chgrp only the group. Only root can give a file to another user.

#chown anna report.txt
#chown anna:finance report.txt
#chown :finance report.txt
#chgrp finance report.txt
#chown -R apache:apache /var/www/html/app
$ls -l report.txt
-rw-r-----. 1 anna finance 512 Oct 27 10:03 report.txt

Let op

chown -R on the wrong path (for example / instead of ./) breaks the whole system. Check the path two times.

11.6

Set default rights with umask

New files start with 666 and new folders with 777. The umask takes rights away. With umask 022 you get files 644 and folders 755.

$umask
0022
$touch a.txt ; mkdir b
$ls -ld a.txt b
-rw-r--r--. 1 student student    0 Oct 27 11:00 a.txt
drwxr-xr-x. 2 student student    6 Oct 27 11:00 b
$umask 027
$touch c.txt ; ls -l c.txt
-rw-r-----. 1 student student 0 Oct 27 11:01 c.txt

umask	New files	New folders
`022`	`644`	`755`
`002`	`664`	`775`
`027`	`640`	`750`
`077`	`600`	`700`

umask NNN works only in the current shell. To keep it, put it in ~/.bashrc (one user) or a file in /etc/profile.d/ (all users).

11.7

Use the special rights

Three special rights solve special problems: SUID, SGID and the sticky bit.

Right	Number	On a file	On a folder
SUID (`u+s`)	4000	Runs with the rights of the owner (example: `passwd`)	—
SGID (`g+s`)	2000	Runs with the rights of the group	New files get the group of the folder
Sticky (`o+t`)	1000	—	Users can delete only their own files (example: `/tmp`)

$ls -ld /tmp
drwxrwxrwt. 18 root root 4096 Oct 27 11:05 /tmp
#find / -perm -4000 -type f 2> /dev/null

Let op

Every SUID-root program is a possible way to become root. Check the list from time to time; a new unknown SUID file is a warning sign.

11.8

Build a shared team folder

A good team folder: owned by the team group, SGID so new files get the group, sticky so people can not delete each other's files, no access for others.

#groupadd sales
#usermod -aG sales anna
#usermod -aG sales omar
#mkdir -p /srv/sales
#chgrp sales /srv/sales
#chmod 3770 /srv/sales
#ls -ld /srv/sales
drwxrws--T. 2 root sales 6 Oct 27 11:10 /srv/sales

3770 = SGID (2) + sticky (1), then rwx for owner and group, nothing for others.

Controleer het

$touch /srv/sales/plan.txt
$ls -l /srv/sales/plan.txt
-rw-r--r--. 1 anna sales 0 Oct 27 11:12 /srv/sales/plan.txt

Next step for finer rights (one extra user, default rights for new files): ACLs.

Read the permission string

Know what r, w and x do

Change rights with numbers

Change rights with letters

Change the owner and the group

Set default rights with umask

Use the special rights

Build a shared team folder

Oefenen

Alle commando's in dit hoofdstuk