====== UNIX/Linux base file permissions ======
https://www.stationx.net/linux-file-permissions-cheat-sheet/
https://abcofaix.wordpress.com/tag/sticky-bit/
===== UNIX/Linux standard Permissions =====
When listing a file or folder on UNIX, using detailed view you 'll see the permissions and owner...
[root@aix01]/root# ls -lsa
0 drwxr-x--- 2 root system 256 Aug 16 16:56 bar
{{unix:unix_file_permissions01.png?650|}}
{{unix:unix_file_permissions02.png?650|}}
The first character indicates the type of file:
– : represents an ordinary file
d: represents a directory
l: symbolic link
c: represents a character device file
b: represents a block device file
The table below gives numbers for all permission types of a File/Directory.
^Number ^ Octal Permission Representation ^ Symbol ^
| 0 | No Permission | --- |
| 1 | Execute | -–x |
| 2 | Write | -w- |
| 3 |Execute and write permission: 1(execute)+2(write)=3 | -wx |
| 4 | Read | r–- |
| 5 |Read and execute permission: 4(read)+1(execute)=5 | r-x |
| 6 |Read and write permission: 4(read)+2(write)=6| rw- |
| 7 |All permissions: 4(read)+2(write)+1(execute)=7| rwx |
2 ways to change unix permissions:
=== Adding or remove rights ===
$ chmod u-x,g=rx,o+wx testfile
$ ls -l testfile
-rw-r-xrwx 1 user01 users 1024 Nov 2 00:10 testfile
=== Using absolute permissions (octal) ===
$ chmod 647 testfile
$ ls -l testfile
-rw-r-xrwx 1 user01 users 1024 Nov 2 00:10 testfile
List file properties and octal permissions
$ stat testfile
File: testfile
Size: 256 Blocks: 0 IO Block: 4096 directory
Device: 8000002200000007h/9223372182883663879d Inode: 774148 Links: 2
Access: (0647/-rw-r-xrwx) Uid: ( 1000/ user01) Gid: ( 1001/ mygroup01)
Access: 2023-08-17 09:59:39.000000000 +0200
Modify: 2022-04-11 11:06:46.000000000 +0200
Change: 2022-04-11 11:06:46.000000000 +0200
Birth: -
===== Special permission: setuid, setgid, and the Sticky Bit =====
Setuid, setgid, and the sticky bit can be tough for new and aspiring Linux admins to understand. It's easy enough to do a web search for the basic definitions:
* **setuid**: a bit that makes an executable run with the privileges of the owner of the file
* **setgid**: a bit that makes an executable run with the privileges of the group of the file
* **sticky bit**: a bit set on directories that allows only the owner or root can delete files and subdirectories
==== user +s ====
**setuid** example
A non-root user is not able to edit the passwd file, but every user can change his own password. This is due to
the sticky bit positionned on the executable command **passwd**, Which 'll execute the passwd command as root,
because the sticky bit is positionned on the program
[root@srvadm01]/root# ll /etc/security/passwd
4 -rw------- 1 root system 1505 Jun 06 13:42 /etc/security/passwd
[root@srvadm01]/root# ll /usr/bin/passwd
44 -r-sr-xr-x 1 root security 44959 Feb 25 2022 /usr/bin/passwd
==== group +s ====
this special permission has a couple of functions:
* If set on a file, it allows the file to be executed as the group that owns the file (similar to SUID)
* If set on a directory, any files created in the directory will have their group ownership set to that of the directory owner
==== other + t (sticky) ====
This permission does not affect individual files. However, at the directory level, it restricts file deletion. Only the owner (and root) of a file can remove the file within that directory.
==== Setting special permissions ====
2 ways to set special permissions:
* To do this using the symbolic method, we do the following:
[root@srvadm01]/root# chmod g+s community_content/
* Using the numerical method, we need to pass a fourth, preceding digit in our chmod command. The digit used is calculated similarly to the standard permission digits:
Start at 0
SUID = 4
SGID = 2
Sticky = 1
The syntax is:
chmod X### file | directory
Where X is the special permissions digit.
Here is the command to set SGID on community_content using the numerical method:
[root@srvadm01]/root# chmod 2770 community_content/
[root@srvadm01]/root# ls -ld community_content/
drwxrws---. 2 user01 staff 113 Apr 7 11:32 community_content/
==== Listing all files with the setuid or setgid bit set ====
[root@srvadm01]/root# find / -perm /6000 -type f
[root@srvadm01]/root# find / -type d -perm -1000 -exec ls -ld {} \;
drwxrwxrwt 1 root system 7 Aug 16 15:06 /aha
drwxrwxrwt 1 root system 3 Aug 16 15:06 /aha/mem
drwxr----t 3 oracle dba 256 Apr 11 2022 /opt/admindev/oracle/product/19.5.0.0.191015-171/suptools/release/diag/tfa/tfactl
drwxr----T 2 oracle dba 256 Apr 11 2022 /opt/admindev/oracle/product/19.5.0.0.191015-171/suptools/release/diag/tfa/tfactl/user_oracle/alert
===== Advanced permission: ACL (access control list) =====
Access Control List are not available on every kind of filesystems !
===== Ownership and groups =====
While creating an account on Unix, it assigns a **owner ID** and a **group ID** to each user. All the permissions mentioned above are also assigned based on the Owner and the Groups.
Changing owner
$ chown user02 testfile
$ ls -l testfile
-rw-r-xrwx 1 user02 users 1024 Nov 2 00:10 testfile
Changing group
$ chgrp mygroup01 testfile
$ ls -l testfile
-rw-r-xrwx 1 user02 mygroup01 1024 Nov 2 00:10 testfile
List owner and group of files and folders
[root@aix01]/export# ls -lsa
0 drwxr-xr-x 2 root staff 256 Sep 25 2015 powerlinux
4 drwxrwxrwx 16 root nobody 4096 Feb 22 2022 rear
List userID and groupID of files and folders
[root@aix01]/export# ls -n
drwxr-xr-x 2 0 1 256 Sep 25 2015 powerlinux
drwxrwxrwx 16 0 4294967294 4096 Feb 22 2022 rear
FIXME Do not forget, UNIX/Linux use IDs, name of user is just a mapping from UserID (based on /etc/passwd)
==== Umask: file creation rights ====
When you create a file with a specific user, a umask will defined the base rights on the created file.
[lpar2rrd@aix01]/home/lpar2rrd# umask
022
[lpar2rrd@aix01]/home/lpar2rrd# touch testfile
[lpar2rrd@aix01]/home/lpar2rrd# ls -lsa
0 -rw-r--r-- 1 lpar2rrd staff 0 Aug 17 10:16 testfile
The flag consists of three octal digits, each representing the permissions masks for the user, the group, and others. The default permissions are determined by subtracting the umask value from ‘777’ for directories and ‘666’ for files. The default value of the umask is ‘022’.
My file is created with permissions **666-022=644**
On **AIX** a umask is specified by default into **/etc/security/user**, you can specify one per user
# chuser umask=022 user01
On **linux** the default mask is defined into **/etc/bashrc**, maybe also into **/etc/login.defs**. For custom, you can either add into homedir from every user, or globaly by script, you can add it to /etc/bashrc
if [ $UID -gt 199 ] && [ $(/usr/bin/id -gn) == $(/usr/bin/id -un) ]
then
umask 444
else
umask 555
fi