Sponsored Content
Full Discussion: Unix File Permissions
Top Forums UNIX for Beginners Questions & Answers Answers to Frequently Asked Questions Tips and Tutorials Unix File Permissions Post 73757 by Perderabo on Friday 3rd of June 2005 08:40:19 PM
Old 06-03-2005
Enforcement Mode File Locking/Manditory File Locking

We aren't finished with that Set Gid bit yet... Unix has a concept of file locking. File locking is beyond the scope of this thread. But you need to know that file locking comes in two flavors: advisory and manditory. Which flavor applies to a particular file depending on the permission settings. If the group execute bit is off but the setgid bit is on, any file locks on that file are manditory.

Useless Bit Combination?

Every reference that I have seen says that setgid on / group execute off is a otherwise useless combination. Even Richard Stevens (in Advanced Programming in the Unix Environment) says "Since the set-group-ID bit makes no sense when the group-execute bit is off, the designers of SVR3 chose this way to specify that the locking for a file is to be maditory locking and not advisory locking."

Well consider this case: Fred runs the Human Resources department. Fred and his group often need to lookup the vacation days used for employees. Fred decides to write a program so employees can lookup their own vacation days used. For security, Fred makes this program do a lot of logging. Fred decides that he doesn't want his group to use this program. They have other tools that won't clutter his log. So Fred does:
chown fred:hr vdays
chmod 2701 vdays
Now the vdays program cannot be run by members of hr (except fred). But it can be run by everyone else. And it will assume the gid of hr when it does run. I have written a test program, set it up like this, and have run it on both Solaris and HP-UX. It works.

Effect on ls output

While this bit combination may be useful is some limited cases, for better or worse, it will have two effects. The vdays program does work, but if a lock is attempted on the file, it will be manditory. As a practical matter, this would impact only an occasional program like a debugger. But ls may treat this bit combination differently. I have seen both of these...
Code:
chown fred:hr vdays
chmod 2701 vdays
-rwx--S--x   1 fred     hr          9938 Jul 16  2004 vdays
-rwx--l--x   1 fred     hr          9938 Jul 16  2004 vdays

These 3 Users Gave Thanks to Perderabo For This Post:
 

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Unix permissions

I am currently running jsp pages on unix server. At the top of my page is the import statement: <%@ page import="survey.*"%>. This imports the survey folder which i have placed in the same directory as my jsp page- jsp-servlet. However, when i try to run the page, its gives me an error saying that... (2 Replies)
Discussion started by: moukoko
2 Replies

2. UNIX for Advanced & Expert Users

UNIX File Permissions

Hello, What does the following mean in terms of file permissions. -rw-rwSrw- 1 owner group 999 May 25 2004 file_name What does the "S" stand for. Thanks in advance for your input. :) (3 Replies)
Discussion started by: jerardfjay
3 Replies

3. Solaris

Unix permissions

Is anyone aware of a tool that would produce a report or an extract file of all users, the files thry are allowed to access and their associated rights permitted (Read,Write etc.) (0 Replies)
Discussion started by: mobershaw
0 Replies

4. UNIX for Dummies Questions & Answers

Unix permissions for a newbie

Okay, this may turn out to be something quite simple, but I haven't found the answer so far: 1) Is it possible to retrieve a list of user(ID) file permissions? and then... 2) What is the most efficient way to create an alert/error message when/if those file permissions are denied? ... (2 Replies)
Discussion started by: hades1013
2 Replies

5. Shell Programming and Scripting

Unix File Permissions

I want to change one of my Dir permissions to drwx--S--- Can you tell me which number i have to use. Thanks in Advance (4 Replies)
Discussion started by: veeru
4 Replies

6. UNIX for Dummies Questions & Answers

Unix Permissions

We have a user group ‘norkgrp’ which is having 2 users ‘norkadm’ and ‘oracle’. Further we have a directory ‘fstf_blobs’ where ‘norkadm’ is the owner and ‘norkgrp’ is the group owner. The permission is set as 770. $ ls -lrt drwxrwx--- 2 norkadm norkgrp 1024 Jun 24 05:03 fstf_blobs We... (5 Replies)
Discussion started by: varunrbs
5 Replies

7. Solaris

Unix file, folder permissions, security auditing tools.

I want to periodically check if ASCII password/config files on Unix have 400 or 600 access. Folders and files are owned by designated group and user. Folders and Files do not have world write access. Are there any tools/scripts available for this kind of auditing that I can use on Solaris? (7 Replies)
Discussion started by: kchinnam
7 Replies

8. Shell Programming and Scripting

ksh; Change file permissions, update file, change permissions back?

Hi, I am creating a ksh script to search for a string of text inside files within a directory tree. Some of these file are going to be read/execute only. I know to use chmod to change the permissions of the file, but I want to preserve the original permissions after writing to the file. How can I... (3 Replies)
Discussion started by: right_coaster
3 Replies
chmod(1)						      General Commands Manual							  chmod(1)

Name
       chmod - change file mode

Syntax
       chmod [ -fR ] mode file...

Description
       Permissions on files are set according to mode and file parameters.

       For file, you can specify either a full or partial path.  You can specify multiple files, separated by spaces.

       For mode, you specify one of two variants: absolute mode or symbolic mode.

   Absolute Mode
       For mode in absolute form, you specify an octal number constructed from the sum of one or more of the following values:

	      4000	set user ID on execution (applies to executable files only)
	      2000	set group ID on execution (applies to executable files only)
	      1000	set sticky bit (see for more information)
	      0400	read by owner
	      0200	write by owner
	      0100	execute, or search if file is a directory, by owner
	      0040	read by group
	      0020	write by group
	      0010	execute, or search if file is a directory, by group
	      0004	read by others
	      0002	write by others
	      0001	execute, or search if file is a directory, by others

       For  example, the absolute mode value that provides read, write, and execute permission to owner, read and execute permission to group, and
       read and execute permission to others is 755 (400+200+100+40+10+4+1).  The absolute mode value that provides read, write, and execute  per-
       mission to owner and no permission to group or others is 700 (400+200+100).

   Symbolic Mode
       To specify mode in symbolic form, use the following format:

	      [who] op permission [op permission] ...  Spaces are included in the preceding format so that you can read the arguments; however, as
	      will be shown in examples that follow, you do not enter spaces between mode arguments.

       Specify who using the letters u (for owner), g (for group) and o (for others) either alone or in combination.  You  can	also  specify  the
       letter  a (for all), which is is equivalent to the letter combination ugo.  If you omit the who parameter, a is assumed.  For more informa-
       tion, see

       For the op parameter, specify the plus sign (+) to add permission to the file's mode, the minus sign (-)  to  remove  permission  from  the
       file's  mode,  or the equal sign (=) to assign permission absolutely (denying or revoking any permission not explicitly specified following
       the equal sign).  The first command in the following example provides group with execute permission for in addition to  any  other  permis-
       sions group currently has for The second command limits the permission that group has for to execute alone:
       chmod g+x filea
       chmod g=x fileb

       For  the  permission  parameter,  specify any combination of the letters r (read), w (write), x (execute), s (set owner or group id), and t
       (save text - sticky).  Alternatively, you can specify the letter u, g, or o to set permission for the who parameter to be the same  as  the
       permission  currently granted to the user category indicated by the letter.  In the following example, the group (g) is given the same per-
       missions on as currently granted to owner (u):
       chmod g=u filea

       You can revoke all permissions by specifying the who argument followed by =, and omitting the permission argument.  For example,  the  fol-
       lowing command removes all permissions from others for
       chmod o= fileb

       When  specifying  more than one symbolic mode for file, separate the modes with commas. The mode changes are applied in the sequence speci-
       fied.  In the following example, write permission is added to the permissions already granted to the owner of and group is then granted the
       same permissions on as granted the owner:
       chmod u+w,g=u filea

Options
       -f   Inhibits display of errors that are returned if fails to change the mode on a file.

       -R   Causes  to	recursively descend any directories subordinate to file and to set the specified mode for each file encountered.  However,
	    when symbolic links are encountered, does not change the mode of the link file and does not traverse  the  path  associated  with  the
	    link.  Note that the option is useful only when file identifies a directory that is not empty.

Restrictions
       The permission letter s is used only with who letter u or g.

       Only the owner of a file  or someone logged on as superuser may change the mode of that file.

Examples
       Using  absolute	mode,  provide	read,  write, and search permission to the owner, and read and search permission to others for a directory
       named
       chmod 755 ~harris/public

       Using absolute mode, set the UID for execution to be the UID of of the file owner rather than the UID of the user running  the  program	as
       follows:
       chmod 4000 progrmb

       Using symbolic mode, perform the same operation as described for the preceding example:
       chmod u=s progrmb

       Using symbolic mode, deny write permission to others for the file
       chmod o-w ourspec

       Using symbolic mode, give execute permission on file to all user categories:
       chmod +x myprog

       Using symbolic mode, give write permission to all group members, deny write permission to others, and give search permission to owner on
       chmod g+w,o-r,u+x docdir

       Using  symbolic	mode, give read and execute permissions to others for a directory named and then recursively descend the paths subordinate
       to adding the  same permissions for others on all files and directories included in the subordinate paths:
       chmod -R o+rx programs
       In the preceding example, if were the name of a file rather than a directory, would change the mode only of the file.

See Also
       ls(1), chmod(2), stat(2), umask(2), chown(8)

																	  chmod(1)
All times are GMT -4. The time now is 03:42 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy