LPI Linux Certification in a Nutshell (30 page)

User

The user who owns the file

Group

The group that owns the file

Other

All other users on the system

Table 7-2. File permissions

SUID

The SUID property is for executable files only and
has no effect on directories. Normally the user who launches a
program owns the resulting process. However, if an executable file
has its SUID bit set, the file’s owner owns the resulting process,
no matter who launched it. When SUID is used, the file’s owner is
usually root. This offers anyone temporary root access for the
duration of the command. An example of an SUID program is
passwd
. This command needs special access to
manipulate the shadow password file
(
/etc/shadow
), and runs as user
root
.

Using the SUID bit in cases like
passwd
enhances security by allowing access to secure functions without
giving away the root password. On the other hand, SUID can be a
security risk if access is granted unwisely. For example, consider
a situation where
/bin/vi
was set to SUID
mode. Any user would be able to edit any file on the
system!

SGID

The SGID property works the same way as SUID for
executable files, setting the process group owner to the file’s
group. In addition, the SGID property has a special effect on
directories. When SGID is set on a directory, new files created
within that directory are assigned the same group ownership as the
directory itself. For example, if directory
/home/fin
has the group
finance
and has SGID enabled, then all files
under
/home/fin
are created with group
ownership of
finance
, regardless of the
creator’s group. This is an important attribute for teams,
ensuring that shared files all have the same group
ownership.

Sticky

At one time, the
sticky bit
applied to
executable programs, flagging the system to keep an image of the
program in memory after the program finished running. This
capability increased performance for subsequent uses by
eliminating the programs’ load phase, and was applied to programs
that were large or were run frequently. Modern virtual memory
techniques have made this use unnecessary, and under Linux there
is no need to use the sticky bit on executable programs.

When applied to a directory, the sticky bit offers
additional security for files within the directory. Regardless of
file permissions, the only users who can rename or delete the
files from a directory with the sticky bit set are the file owner,
the directory owner, and
root
. When used in a
team environment, the sticky bit allows groups to create and
modify files but allows only file owners the privilege of deleting
or renaming them. The
/tmp
directory on Linux
systems usually has the sticky bit set, to allow any user to write
to it, but allow only the file owner to delete files or
directories.

The
special, user, group
, and
other
permissions can be represented in a string
of 12 binary bits, as shown in
Figure 7-2
.

Figure 7-2. Changing permission bits to an octal number

It is common to refer to these bits in four sets of three,
translated into four octal (base-8) digits. The first octal digit
represents the
special permissions SUID, SGID, and sticky. The other
three represent the read, write, and execute permissions,
respectively, in each of the user, group, and other user classes.
Octal notation is used as shorthand for binary strings
such as the access mode, and each group of three bits has
2
³
= 8 possible values, listed in
Table 7-3
.

The read permission by itself is
r--
, which can be thought of as binary 100,
or octal 4. Adding the write permission yields
rw-
, or binary 110, which is octal 6.
Figure 7-2
shows how to
total bit values into the octal equivalents. Memorizing, or even
writing, the binary-to-octal equivalents may be easier on the exam
than adding bit values. Use the technique that works best for
you.

To turn the mode bits
110111101001
into an octal representation,
first separate them into chunks of three bits:
110, 111, 101
, and
001
. The first group, representing the
special permissions, is
110
. This can be thought of as 4 + 2 + 0 =
6. The second group, representing user permissions, is
111
, or 4 + 2 + 1 = 7. The third group,
representing group permissions, is
101
, or 4 + 0 + 1 = 5. The last group,
representing other permissions, is
001
, or 0 + 0 + 1 = 1. The mode string for
this example can then be written as the octal 6751.

This is the form used to display the file mode in the output
from the
stat
command. Here, the octal access
mode for the
mount
command is 4755:

#
stat /bin/mount
File: `/bin/mount'
Size: 69100           Blocks: 144        IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 14671934    Links: 1
Access: (4755/-rwsr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2009-08-07 15:40:29.000000000 -0500
Modify: 2009-06-01 06:17:46.000000000 -0500
Change: 2009-06-29 14:37:58.000000000 -0500

The special permissions are represented in this example by octal
4, or binary 100, indicating that the SUID permission is set (
-rws
). The user permission is octal 7, or
binary 111, indicating read, write, and execute for the file’s owner
(in this case,
root
). Both the group and other
permissions are set to octal 5, or binary 101, indicating read and
execute, but not write.

As mentioned earlier, the user, group, and other
permissions are often spelled out in symbolic mode descriptions such
as
rwxr-xr-x
. This notation is
found in the output of the
ls -l
and
stat
commands. As you can see in the access mode
for
mount
, this scheme is modified slightly in
the presence of special permissions. Instead of adding three more bits
to the left of
rwxr-xr-x
, the SUID
permission is indicated in the string by changing the user execute
position from
x
to
s
. SGID permission is handled the same way.
The sticky permission is indicated by replacing
x
in the other execute position with
T
. For example, an executable
program with mode 6755 would have the following equivalent symbolic
mode:

rwsr-sr-x

A directory with mode 1774 would have this equivalent
string:

rwxr-xr-T

While this layering of special permissions may appear to obscure
the underlying execute permissions, it makes sense. The special
permissions are relatively rare in the filesystem, so depicting the
three extra bits would waste space on your terminal or terminal
window. When the executable bits are set, the setuid and setgid bits
are represented with
s
. When the
executable bits are not set, the setuid and setgid bits are
represented with
S
. Similarly, the
sticky bit is represented with either
t
or
T
.