Control Access to Files - RHCSA (RH124).pdf

Slides on how to control access to files - Part of RHCSA (RH124) syllabus

1. Control Access to Files

2. File Permissions
●Safeguard data from unauthorized access or modification
●Use "-l" option in "ls" command to display detailed
information about files and directories.

3. ●Access controls:
○Who can access a file or directory.
○What actions they can perform on them.

6. ●Changes the permissions (r,w,x) of files and directories.
●Syntax: chmod [options] permissions file(s)
Change permission in symbolic mode
○Command: chmod u+x books.txt




Change permission in numeric mode
○Command: chmod 755 library
chmod

7. ●Changes the owner and group ownership of files and
directories.
●Syntax: chown [options] new_owner file(s)
●‘-R’ option on a directory changes ownership of all the files
in the directory.
Change ownership of a file
○Command: chown user1 file.txt




Transfer ownership and group ownsership
○Command: chown user2:group2 demoFile.txt
chown

8. ●Changes the group ownership of files and directories.
●Syntax: chgrp [options] new_group file(s)

Change group ownership
○chgrp group2 file.txt






●The -R option makes the command recursive.
chgrp

9. ●Set default permissions for newly created
files and directories in Linux

●umask values are 4 digit octal numbers

●umask values (umask 0022) are
subtracted from default permissions

●Default permission: 666 for files & 777 for
directories

●1
st
digit in umask represents additional
attributes (sticky bit, setuid, & setgid)
umask

10. Get umask value
○ Command: umask
Set umask value
○Command: umask 0000

11. ●Every application runs on Linux in the context of a specific
user.

●Some applications may need higher privileges.

●Linux provides 3 special permissions:
○setuid

○setgid

○sticky bit
Special Permissions

12. ●Used only for binary files (applications)
●Application with setuid bit set, runs with the effective UID
of the file owner
●Indicated by ‘s’ in place of ‘x’
●Set setuid bit
○Command: chmod u+s uidDemo
setuid

13. ○If user doesn’t have execute ‘x’ permission, setting
setuid its represented by ‘S’ symbol
Remove setuid
○Command: chmod u-s uidDemo

14. ●Used primarily for binary files (applications)
●File runs with permissions of group owning it.
●setgid is indicated by ‘s’ in place of ‘x’
●When applied on directories, files created are owned by
directory owner.
●Set setgid bit
○Command: chmod g+s uidDemo
setgid

15. Remove getuid
○Command: chmod g-s uidDemo

16. ●If owner group doesn’t have execute ‘x’ permission it is
represented by ‘S’ symbol

17. ●Used primarily on directories.
●When set, files created can only be deleted by user who
created it.
●Indicated by ‘t’ in place of ‘x’ in the everyone category.
●In RHEL, sticky bit is set by default on /tmp/
●Set sticky bit
○Command: chmod +t /documents
sticky bit

18. ○If ‘others’ do not have execute permissions, it is
symbolized by ‘T’.
Remove sticky bit
○Command: chmod -t /documents

19. File Capabilities

●Grant specific privileges to executables, avoiding full root
permissions.
●Purpose:
○Precise control over access to system resources.
○Reduce need for processes to run with full root privileges.
●Example:
○Enable non-root processes to bind to port <1024 without
superuser privileges.
○Add ‘CAP_NET_BIND_SERVICE’ capability.

20. Common Capabilities

21. Set capability
○Command: setcap cap_net_raw /bin/ping

Get Capability
○Command: getcap /bin/ping






Get Capability of running process
○Command: getpcaps 1054