 |  |
| |
Unix makes it easy for users to share files and directories. For instance, everyone in a group can read documents stored in one of their manager's directories without needing to make their own copies--if the manager has allowed access. There might be no need to fill peoples' email inboxes with file attachments if everyone can access those files directly through the Unix filesystem.
Here's a brief introduction to file security and sharing. Networked systems with multiple users, such as Unix, have complex security issues that take tens or hundreds of pages to explain. If you have critical security needs or you just want more information, talk to your system staff or see an up-to-date book on Unix security.
WARNING: Note that the system's superuser (the system administrator and possibly other users) can do anything to any file at any time, no matter what its permissions are. So, access permissions won't keep your private information safe from everyone--although let's hope that you can trust your system staff!Your system staff should also keep backup copies of users' files. These backup copies may be readable by anyone who has physical access to them. That is, anyone who can take the backup out of a cabinet (or wherever) and mount it on a computer system may be able to read the file copies. The same is true for files stored on floppy disks and any other removable media. (Once you take a file off of a Unix system, that system can't control access to it anymore.)
A directory's access permissions help to control access to the files and subdirectories in that directory:
If a directory has read permission, a user can run ls to see what's in the directory and use wildcards to match files in it.
A directory that has write permission allows users to add, rename, and delete files in the directory.
To access a directory--that is, to read or write the files in the directory or to run the files if they're programs--a user needs execute permission on that directory. Note that to access a directory, a user must also have execute permission to all of its parent directories, all the way up to the root!
The access permissions on a file control what can be done to the file's contents. The access permissions on the directory where the file is kept control whether the file can be renamed or removed. (If this seems confusing, think of it this way: the directory is actually a list of files. Adding, renaming, or removing a file changes the contents of the directory. If the directory isn't writable, you can't change that list.)
Read permission controls whether you can read a file's contents. Write permission lets you change a file's contents. A file shouldn't have execute permission unless it's a program.
Once you know what permissions a file or directory needs--and if you're the owner (listed in the third column of ls -l output)--you can change the permissions with the chmod program.
There are two ways to change permissions: by specifying the permissions to add or delete, or by specifying the exact permissions.[8] For instance, if a directory's permissions are almost correct, but you also need to make it writable by its group, tell chmod to add group-write permission. But if you need to make more than one change to the permissions--for instance, you want to add read and execute permission, but delete write permission--it's easier to set all permissions explicitly instead of changing them one-by-one. The syntax is:
[8] Early versions of chmod can't add or delete particular permissions. Instead, you have to give an exact permission as three digits between 0 and 7. If you need to use chmod that way, please see a more detailed Unix reference.
chmod permissions file(s)
Let's start with the rules; we see examples next. The permissions argument has three parts, which you must give in order with no space between.
The category of permission you want to change. There are three: the owner's permission (which chmod calls "user," abbreviated u), the group's permission (g), or others' permission (o). To change more than one category, string the letters together, such as go for "group and others," or simply use a to mean "all" (same as ugo).
Whether you want to add (+) the permission, delete (-) it, or specify it exactly (=).
What permissions you want to affect: read (r), write (w), or execute (x). To change more than one permission, string the letters together--for example, rw for "read and write."
Some examples should make this clearer! In the following command lines, you can replace dirname or filename with the pathname (absolute or relative) of the directory or file. An easy way to change permissions on the working directory is by using its relative pathname, . (dot), as in "chmod a-w .". You can combine two permission changes in the same chmod command by separating them with a comma (,), as shown in the final example.
To protect a file from accidental editing, delete everyone's write permission with the command "chmod a-w filename". On the other hand, if you own an unwritable file that you want to edit, but you don't want to change other peoples' write permissions, you can add "user" (owner) write permission with "chmod u+w filename".
To keep yourself from accidentally removing files (or adding or renaming files) in an important directory of yours, delete your own write permission with the command "chmod u-w dirname". If other users have that permission, too, you could delete everyone's write permission with "chmod a-w dirname".
If you want you and your group to be able to read and write all the files in your working directory--but those files have various permissions now, so adding and deleting the permissions individually would be a pain--this is a good place to use the = operator to set the exact permissions you want. Use the filename wildcard *, which means "everything in this directory" (explained in Section 4.2 of Chapter 4) and type: "chmod ug=rw *".
If your working directory had any subdirectories, though, that command would be wrong because it takes away execute permission from the subdirectories, so the subdirectories couldn't be accessed anymore. In that case, you could try a more specific wildcard. Or, instead of a wildcard, you can simply list the filenames you want to change, separated by spaces, as in "chmod ug=rw afile bfile cfile".
To protect the files in a directory and all its subdirectories from everyone else on your system, but still keep the access permissions you have there, you could use "chmod go-rwx dirname" in order to delete all "group" and "others" permission to read, write, and execute. A simpler way is to use the command "chmod go= dirname" to set "group" and "others" permission to exactly nothing.
You want full access to a directory. Other people on the system should be able to see what's in the directory--and read or edit the files if the file permissions allow it--but not rename, remove, or add files. To do that, give yourself all permissions, but give "group" and "others" only read and execute permission. Use the command "chmod u=rwx,go=rx dirname".
After you change permissions, it's a good idea to check your work at first with "ls -l filename" or "ls -ld dirname".
Most Linux systems have a program named chattr that gives you more choices on file and directory protection. chattr is being developed, and your version may not have all the features that it will have in later Linux versions. For instance, chattr can make a Linux file append-only (so it can't be overwritten, only added to), compressed (to save disk space automatically), immutable (so it can't be changed at all), undeletable, and more. Check your online documentation (type man chattr--see Chapter 8).
The problem may also be in the permissions of the file's directory. Some programs need permission to write more files into the same directory (for example, temporary files), or to rename files (for instance, making a file into a backup) while editing. If it's safe to add write permission to the directory (if other files in the directory don't need protection from removal or renaming) try that. Otherwise, copy the file to a writable directory (with cp), edit it there, then copy it back to the original directory.
Group ownership lets a certain group of users have access to a file or directory. You might need to let a different group have access. The chgrp program sets the group owner of a file or directory. You can set the group to any of the groups you belong to. (The system staff control the list of groups you're in.) On most versions of Unix, the groups program lists your groups.
For example, if you're an instructor creating a directory named csc303 for students in a course, the directory's original group owner might be faculty. You'd like the students, all of whom are in the group named csstudnt, to access the directory; members of other groups should have no access. Use commands such as these:[9]
[9] Many Unix systems also let you set a directory's group ownership so that any files you later create in that directory will be owned by the same group as the directory. Try the command "chmod g+s dirname". If this works, the permissions listing from ls -ld should show an s in place of the second x, such as drwxr-s---.
$ groups faculty csstudnt wheel research $ mkdir csc303 $ ls -ld csc303 drwxr-xr-x 2 roberts faculty 4096 Aug 25 13:35 csc303 $ chgrp csstudnt csc303 $ chmod o= csc303 $ ls -ld csc303 drwxr-x--- 2 roberts csstudnt 4096 Aug 25 13:35 csc303
The chown program changes the owner of a file or directory. On most Unix systems, only the superuser can use chown.[10]
[10] If you have permission to read another user's file, you can make a copy of it (with cp; see Section 4.4.2 in Chapter 4). You'll own the copy.
|  | |
| 3.2. Looking Inside Files with less |  | 3.4. Graphical Filesystem Browsers |
Copyright © 2003 O'Reilly & Associates. All rights reserved.