Sponsored Content
Full Discussion: Unix File Permissions
Top Forums UNIX for Beginners Questions & Answers Answers to Frequently Asked Questions Tips and Tutorials Unix File Permissions Post 73757 by Perderabo on Friday 3rd of June 2005 08:40:19 PM
Old 06-03-2005
Enforcement Mode File Locking/Manditory File Locking

We aren't finished with that Set Gid bit yet... Unix has a concept of file locking. File locking is beyond the scope of this thread. But you need to know that file locking comes in two flavors: advisory and manditory. Which flavor applies to a particular file depending on the permission settings. If the group execute bit is off but the setgid bit is on, any file locks on that file are manditory.

Useless Bit Combination?

Every reference that I have seen says that setgid on / group execute off is a otherwise useless combination. Even Richard Stevens (in Advanced Programming in the Unix Environment) says "Since the set-group-ID bit makes no sense when the group-execute bit is off, the designers of SVR3 chose this way to specify that the locking for a file is to be maditory locking and not advisory locking."

Well consider this case: Fred runs the Human Resources department. Fred and his group often need to lookup the vacation days used for employees. Fred decides to write a program so employees can lookup their own vacation days used. For security, Fred makes this program do a lot of logging. Fred decides that he doesn't want his group to use this program. They have other tools that won't clutter his log. So Fred does:
chown fred:hr vdays
chmod 2701 vdays
Now the vdays program cannot be run by members of hr (except fred). But it can be run by everyone else. And it will assume the gid of hr when it does run. I have written a test program, set it up like this, and have run it on both Solaris and HP-UX. It works.

Effect on ls output

While this bit combination may be useful is some limited cases, for better or worse, it will have two effects. The vdays program does work, but if a lock is attempted on the file, it will be manditory. As a practical matter, this would impact only an occasional program like a debugger. But ls may treat this bit combination differently. I have seen both of these...
Code:
chown fred:hr vdays
chmod 2701 vdays
-rwx--S--x   1 fred     hr          9938 Jul 16  2004 vdays
-rwx--l--x   1 fred     hr          9938 Jul 16  2004 vdays

These 3 Users Gave Thanks to Perderabo For This Post:
 

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Unix permissions

I am currently running jsp pages on unix server. At the top of my page is the import statement: <%@ page import="survey.*"%>. This imports the survey folder which i have placed in the same directory as my jsp page- jsp-servlet. However, when i try to run the page, its gives me an error saying that... (2 Replies)
Discussion started by: moukoko
2 Replies

2. UNIX for Advanced & Expert Users

UNIX File Permissions

Hello, What does the following mean in terms of file permissions. -rw-rwSrw- 1 owner group 999 May 25 2004 file_name What does the "S" stand for. Thanks in advance for your input. :) (3 Replies)
Discussion started by: jerardfjay
3 Replies

3. Solaris

Unix permissions

Is anyone aware of a tool that would produce a report or an extract file of all users, the files thry are allowed to access and their associated rights permitted (Read,Write etc.) (0 Replies)
Discussion started by: mobershaw
0 Replies

4. UNIX for Dummies Questions & Answers

Unix permissions for a newbie

Okay, this may turn out to be something quite simple, but I haven't found the answer so far: 1) Is it possible to retrieve a list of user(ID) file permissions? and then... 2) What is the most efficient way to create an alert/error message when/if those file permissions are denied? ... (2 Replies)
Discussion started by: hades1013
2 Replies

5. Shell Programming and Scripting

Unix File Permissions

I want to change one of my Dir permissions to drwx--S--- Can you tell me which number i have to use. Thanks in Advance (4 Replies)
Discussion started by: veeru
4 Replies

6. UNIX for Dummies Questions & Answers

Unix Permissions

We have a user group ‘norkgrp’ which is having 2 users ‘norkadm’ and ‘oracle’. Further we have a directory ‘fstf_blobs’ where ‘norkadm’ is the owner and ‘norkgrp’ is the group owner. The permission is set as 770. $ ls -lrt drwxrwx--- 2 norkadm norkgrp 1024 Jun 24 05:03 fstf_blobs We... (5 Replies)
Discussion started by: varunrbs
5 Replies

7. Solaris

Unix file, folder permissions, security auditing tools.

I want to periodically check if ASCII password/config files on Unix have 400 or 600 access. Folders and files are owned by designated group and user. Folders and Files do not have world write access. Are there any tools/scripts available for this kind of auditing that I can use on Solaris? (7 Replies)
Discussion started by: kchinnam
7 Replies

8. Shell Programming and Scripting

ksh; Change file permissions, update file, change permissions back?

Hi, I am creating a ksh script to search for a string of text inside files within a directory tree. Some of these file are going to be read/execute only. I know to use chmod to change the permissions of the file, but I want to preserve the original permissions after writing to the file. How can I... (3 Replies)
Discussion started by: right_coaster
3 Replies
CHMOD(1)						    BSD General Commands Manual 						  CHMOD(1)

NAME
chmod -- change file modes SYNOPSIS
chmod [-R [-H | -L | -P]] [-fh] mode file ... DESCRIPTION
The chmod utility modifies the file mode bits of the listed files as specified by the mode operand. The options are as follows: -H If the -R option is specified, symbolic links on the command line are followed. (Symbolic links encountered in the tree traversal are not followed.) -L If the -R option is specified, all symbolic links are followed. -P If the -R option is specified, no symbolic links are followed. -R Change the modes of the file hierarchies rooted in the files instead of just the files themselves. -f Do not display a diagnostic message or modify the exit status if chmod fails to change the mode of a file. -h If file is symbolic link, the mode of the link is changed. The -H, -L and -P options are ignored unless the -R option is specified. In addition, these options override each other and the command's actions are determined by the last one specified. Only the owner of a file or the super-user is permitted to change the mode of a file. EXIT STATUS
The chmod utility exits 0 on success, and >0 if an error occurs. MODES
Modes may be absolute or symbolic. An absolute mode is an octal number constructed by or'ing the following values: 4000 set-user-ID-on-execution 2000 set-group-ID-on-execution 1000 sticky bit, see chmod(2) 0400 read by owner 0200 write by owner 0100 execute (or search for directories) by owner 0070 read, write, execute/search by group 0007 read, write, execute/search by others The read, write, and execute/search values for group and others are encoded as described for owner. The symbolic mode is described by the following grammar: mode ::= clause [, clause ...] clause ::= [who ...] [action ...] last_action action ::= op [perm ...] last_action ::= op [perm ...] who ::= a | u | g | o op ::= + | - | = perm ::= r | s | t | w | x | X | u | g | o The who symbols ``u'', ``g'', and ``o'' specify the user, group, and other parts of the mode bits, respectively. The who symbol ``a'' is equivalent to ``ugo''. The perm symbols represent the portions of the mode bits as follows: r The read bits. s The set-user-ID-on-execution and set-group-ID-on-execution bits. t The sticky bit. w The write bits. x The execute/search bits. X The execute/search bits if the file is a directory or any of the execute/search bits are set in the original (unmodified) mode. Operations with the perm symbol ``X'' are only meaningful in conjunction with the op symbol ``+'', and are ignored in all other cases. u The user permission bits in the mode of the original file. g The group permission bits in the mode of the original file. o The other permission bits in the mode of the original file. The op symbols represent the operation performed, as follows: + If no value is supplied for perm, the ``+'' operation has no effect. If no value is supplied for who, each permission bit specified in perm, for which the corresponding bit in the file mode creation mask is clear, is set. Otherwise, the mode bits represented by the specified who and perm values are set. - If no value is supplied for perm, the ``-'' operation has no effect. If no value is supplied for who, each permission bit specified in perm, for which the corresponding bit in the file mode creation mask is clear, is cleared. Otherwise, the mode bits represented by the specified who and perm values are cleared. = The mode bits specified by the who value are cleared, or, if no who value is specified, the owner, group and other mode bits are cleared. Then, if no value is supplied for who, each permission bit specified in perm, for which the corresponding bit in the file mode creation mask is clear, is set. Otherwise, the mode bits represented by the specified who and perm values are set. Each clause specifies one or more operations to be performed on the mode bits, and each operation is applied to the mode bits in the order specified. Operations upon the other permissions only (specified by the symbol ``o'' by itself), in combination with the perm symbols ``s'' or ``t'', are ignored. EXAMPLES
644 make a file readable by anyone and writable by the owner only. go-w deny write permission to group and others. =rw,+X set the read and write permissions to the usual defaults, but retain any execute permissions that are currently set. +X make a directory or file searchable/executable by everyone if it is already searchable/executable by anyone. 755 u=rwx,go=rx u=rwx,go=u-w make a file readable/executable by everyone and writable by the owner only. go= clear all mode bits for group and others. g=u-w set the group bits equal to the user bits, but clear the group write bit. SEE ALSO
chflags(1), install(1), chmod(2), stat(2), umask(2), fts(3), setmode(3), symlink(7), chown(8) STANDARDS
The chmod utility is expected to be IEEE Std 1003.2-1992 (``POSIX.2'') compatible with the exception of the perm symbol ``t'' which is not included in that standard. BUGS
There's no perm option for the naughty bits. BSD
January 22, 2010 BSD
All times are GMT -4. The time now is 03:10 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy