Review of Fundamentals (cont’d) 1 • change your password on CLS if you haven’t already • the filesystem • access permissions • symbolic links • hard links 2 • Variables for general use (variables that are not environment variables) have lower case names • Environment variables are indicated by their UPPER CASE names: SHELL, VISUAL, etc • It's usually best to put variable expansions inside double quotes, to protect any special characters that might be inside the variable: echo "$somevar" ◦ if somevar contained the * character, the double quotes stop the shell from globbing it 3 • set the variable myvar to have value value myvar=value • Note, to make this variable setting visible in sub processes we use export export myvar=value or myvar=value export myvar 4 ◦ set the myvar variable to have a null value, then run the value command with that variable setting in effect myvar= command • Notice that if you try mistakenly use this to try to set the value of myvar to value myvar= value in this case you are actually trying to run a command called value 5 The usual way to use this mechanism is something like VISUAL=nano vipw • This means to set the value of the environment VISUAL variable to nano, and use that while the vipw command runs 6 ◦ set the myvar variable to have a null value, then run the value command with that variable setting in effect myvar= value ◦ run the myvar command with one argument, namely =value myvar =value • run the myvar command with two arguments, namely = and value myvar = value 7 • Sobel, Chapter 6 • 160_pathnames.html Unix/Linux Pathnames (absolute, relative, dot, dot dot) • 450_file_system.html Unix/Linux File System - (correct explanation) • 460_links_and_inodes.html Hard links and Unix file system nodes (inodes) • 460_symbolic_links.html Symbolic Links - Soft Links - Symlinks • 500_permissions.html Unix Modes and Permissions • 510_umask.html Umask and Permissions 8 9 inode 5242946 - rw-rw-r-- access time inode 5242914 modification time drwxr-x--- change time access time …etc… modification time change time data blocks for …etc… the file there is no . inode 5242914 filename here the filename(s) .. (at least one) are stored in directories .bash_history inode 5242915 .bash_profile inode 5242946 …etc… …etc… 10 inode 5242914 drwxr-x--- access time Need read (r) on modification time directory to read this change time column …etc… . inode 5242914 Need search (x) on directory to access this .. column .bash_history inode 5242915 Need write (w) and .bash_profile inode 5242946 search (x) on directory to change first column …etc… …etc… 11 inode 5242946 -rw-rw-r-- access time Need search (x) on modification time directory this file is in change time to access this info on …etc… the file’s inode data blocks for the file there is no Need read (r) / write filename here (w) / execute (x) on file the filename(s) to read / write / execute (at least one) are this file (contents) stored in directories 12 13 Information given by long listing: ls -l 10 characters • file type as the first letter • access modes (remaining letters) Link count • number of links to this file or directory User-owner Login Name • user who owns the file/directory • based on owner UID User-owner Group Name • group who owns the file/directory • based on owner GID File Size • size (in bytes or K) of the file/directory Date/Time Modified •date and time when last created / modified / saved File Name • actual file/directory name • Linux recognizes and identifies several file types, which is coded into the first letter of the first field of information about the file: • - (dash)a regular file • b block device special file • c character device special file • d a directory • l a symbolic (soft) link • p a named pipe or FIFO • s socket special filename • In Linux, 3 types of access permissions or privileges can be associated with a file: – read (r) grants rights to read a file – write (w) grants rights to write to, or change, a file – execute (x) grants rights to execute the file (to run the file as a command) • All 3 permissions can then be applied to each of 3 types of users: – User: owner of the file – Group: group to which user must belong to gain associated rights – Others: not User and not member of Group (sometimes called “World” or “Everybody”) Octal representation of permissions Octal r w x Value Meaning 0 0 0 0 No permission 0 0 1 1 Execute-only permission 0 1 0 2 Write-only permission 0 1 1 3 Write and execute permissions 1 0 0 4 Read-only permission 1 0 1 5 Read and execute permissions 1 1 0 6 Read and write permissions 1 1 1 7 Read, write and execute permissions • The same three types of access permissions or privileges are associated with a directory, but with some differences: – read (r) rights to read the directory – write (w) rights to create or remove in the directory – execute/search (x) rights to access the directory meaning, cd into the directory, or access inodes it contains, or “pass through” All three permissions can then be applied to each of three types of users as before. – User owner/creator of the file – Group group to which user must belong – Others everyone else (Rest-of-world) • Three special access bits. These can be combined as needed. • SUID - Set User ID bit ‧ When this bit is set on a file, the effective User ID of a process resulting from executing the file is that of the owner of the file, rather than the user that executed the file ‧ For example, check the long listing of /usr/bin/passwd – the SUID bit makes this program run as root even when invoked by a regular user – allowing regular users to change their own password chmod 4xxx file-list chmod u+s file-list • SGID - Set Group ID bit ‧ Similar to SUID, except an executable file with this bit set will run with effective Group ID of the owner of the file instead of the user who executed the file. chmod 2xxx file-list chmod g+s file-list • sticky bit (restricted deletion flag) ‧ The sticky bit on a directory prevents unprivileged users from removing or renaming a file in the directory unless they are the owner of the file or the directory ‧ for example, /tmp is a world-writeable directory where all users need to create files, but only the owner of a file should be able to delete it. ‧ without the sticky bit, hostile users could remove all files in /tmp; whereas with the sticky bit, they can remove only their own files. chmod 1xxx dir-list chmod +t dir-list • The permissions a user will have is determined in this way: ‧ If the user is the owner of the file or directory, then the user rights are used. ‧ If the user is not the owner but is a member of the group owning the file or directory, then the group rights are used. ‧ If the user is neither the owner nor a part of the group owning the file, then the other rights are used. • NOTE: It is possible to give the “world” more permissions that the owner of the file. For example, the unusual permissions -r--rw-rw- would prevent only the owner from changing the file – all others could change it! • The permissions assigned to newly created files or directories are determined by the umask value of your shell. • Commands: ‧ umask - display current umask ‧ umask xyz - sets new umask to an octal value xyz ‧ permissions on a newly created file or directory are calculated as follows: ‧ start with a “default” of 777 for a directory or 666 for a file ‧ for any 1 in the binary representation of the umask, change the corresponding bit to 0 in the binary representation of the default ‧ umask is a reverse mask: the binary representation tells you what bits in the 777 or 666 default will be 0 in the permissions of the newly created file or directory • if umask is 022 ◦ binary umask representation: 000010010 = 022 ◦ default file permissions 666: 110110110 ◦ permissions on new file: 110100100 = 644 • if umask is 002 ◦ binary umask representation: 000000010 = 002 ◦ default file permissions 666: 110110110 ◦ permissions on new file: 110110100 = 664 • if umask is 003 ◦ binary umask representation: 000000011 = 003 ◦ default file permissions 666: 110110110 ◦ permissions on new file: 110110100 = 664 24 • notice that for files, a umask of 003 ends up doing the same thing as a umask of 002 • Why? 25 • if umask is 022 ◦ binary umask representation: 000010010 = 022 ◦ default dir permissions 777: 111111111 ◦ permissions on new dir : 111101101 = 755 • if umask is 002 ◦ binary umask representation: 000000010 = 002 ◦ default dir permissions 777: 111111111 ◦ permissions on new dir : 111111101 = 775 • if umask is 003 ◦ binary umask representation: 000000011 = 003 ◦ default dir permissions 777: 111111111 ◦ permissions on new dir : 111111100 = 774 26 • notice that for directories, a umask of 003 gives different results than a umask of 002 • Why? 27 • It is important for the Linux file system manager to govern permissions and other file attributes for each file and directory, including – ownership of files and directories – access rights on files and directories – The 3 timestamps seen in stat (man stat) • The information is maintained within the file system information (inodes) on the hard disk • This information affects every file system action. • chown owner[:group] files ‧ Change ownership of files and directories (available for root only) Examples: chown guest:guest file1 dir2 • change ownership of file1 and dir2 to user guest and group guest chown guest dir2 • change ownership of dir2 to user guest but leave the group the same chown :guest file1 • change ownership of file1 to group guest but leave the user the same (can also use chgrp) • chmod permissions files ‧ Explicitly change file access permissions Examples: chmod +x file1 • changes file1 to have executable rights for user/group/other, subject to umask chmod u+r,g-w,o-rw file2 • changes file2 to add read rights for user, remove write rights for group and remove both read and write rights for others chmod 550 dir2 • changes dir2 to have only read and execute rights for user and group but no rights for other • create a command with basic scripting ◦ put “#!/bin/sh –u” at very beginning of file ◦ PATH=/bin:/usr/bin ; export PATH ◦ umask 022 ◦ put commands in file ◦ make file executable • put the file in a directory that is in $PATH • http://teaching.idallen.ca/cst8207/14w/notes/400_search_path.html • Not a good idea to put “.” in PATH • Security implications of putting “current directory” , “.” in PATH • PATH=.:$PATH • demonstration of how the bad guy can arrange for you to inadvertently run their malicious commands as you 31