Access Control & Ownership
Last updated
Last updated
A Sticky bit is a permission bit that is set on a file or a directory that lets only the owner of the file/directory or the root user to delete or rename the file. No other user is given privileges to delete the file created by some other user.
Now, turn ON/OFF the sticky bit on the directory by using +t flag of chmod command.
to set sticky bit on a file with numeric permission format, give 1 before you specify other numbered privileges, as shown below. The example below, gives rwx permission to user, group and others (and also adds the sticky bit to the directory).
The chown command changes a file’s ownership, and the chgrp command changes its group ownership. The syntax of chown and chgrp mirrors that of chmod, except that the first argument is the new owner or group, respectively.
chown can change both the owner and group of a file at once with the syntax
You can use the built-in shell command umask to influence the default permissions given to the files you create. Every process has its own umask attribute; the shell’s built-in umask command sets the shell’s own umask, which is then inherited by commands that you run.
For example, umask 027 allows all permissions for the owner but forbids write permission to the group and allows no permissions for anyone else.
The file creation mask can be set using octal or symbolic notation. To make the changes permanent, set the new umask value in a global configuration file like /etc/profile file which will affect all users or in a user’s shell configuration files such as ~/.profile, ~/.bashrc or ~/.zshrc, which will affect only the user. The user files have precedence over the global files.
Before making changes to the umask value, make sure the new value doesn’t pose a potential security risk. Values less restrictive than 022 should be used with great caution. For example, umask 000 means anyone has read, write, and execute permissions on all newly created files.
Let’s say we want to set more restrictive permissions for the newly created files and directories so others will not be able to cd to the directories and read files. The permissions we want are 750 for directories and 640 for files.
To calculate the umask value, simply subtract the desired permissions from the default one:
Umask value: 777-750 = 027
The desired umask value represented in numeric notation is 027.
To permanently set the new value system-wide, open the /etc/profile file with your text editor:
and change or add the following line at the beginning of the file:
/etc/profile
For changes to take effect, run the following source command or log out and log in:
If you check the permissions using the ls command, you will notice that the new file has 640 and the new directory 750 permissions, as we wanted:
Another way to set the file creation mask is by using symbolic notation. For example umask u=rwx,g=rx,o= is same as umask 027
ACL = Access Control List
Provides additional control Example: Give one user access to a file. Traditional solution is to create another group.
Access : Control access to a specific file or directory.
Default : Used on directories only. Files without access rules use the default ACL rules. Not retroactive. Optional.
setfacl and getfacl are used for setting up ACL and showing ACL respectively.
Users and groups can be identified by name or by UID/GID. The exact number of entries that an ACL can contain varies with the filesystem implementation but is usually at least 32.
u:uid:perms Set the access ACL for a user.
if you're using tar for backup, use --acls to keep the ACLs when creating an archive.
example commands:
To add permission for user
To add permissions for a group
To allow all files or directories to inherit ACL entries from the directory it is within.
To remove a specific entry
To remove all entries
example:
Using the tar --acls option to prevent the loss of ACLs during a backup
First, sets the normal permissions:
then set the ACL for user2:
Linux defines a set of supplemental flags that can be set on files to request special handling. For example, the a flag makes a file append-only, and the i flag makes it immutable and undeletable
Linux uses the commands lsattr and chattr to view and change file attributes
Use the chattr command.
To verify the new settings, we will create one new file and directory using and :
