Now imagine we enter the command LS
L
and in some directory, we see this list of files,
we see that these are owned by the Alex user and the staff group.
The first three permission bits RW dash tell us
that Alex can read and write to these files.
The next three RW dash tell us that any user
belonging to the staff group can also read and write.
And finally the last three permission bits R dash dash show us that all
of the other users can only read these files but not write to them.
Now, as we can see,
only the first set of permissions is very specific targeted on a single user.
The other two are very wide applying to everyone in
a group or all the other users on a system.
However, most of the time this isn't a problem.
But now imagine this, we're logged in as a user called Jeremy.
He's obviously not Alex and he doesn't belong to the staff group.
That means that the third set of permissions will be applied to him or dash dash.
But what if we want Jeremy to be able to edit file three?
We could think.
Well, we could add him to the staff group and then he'll be able to edit that file.
But if we add him to that group,
then it'll also have permissions to modify file one and file two.
And we don't want that.
We want to make an Exception for Jeremy just for file three.
We could make Jeremy the owner of that file, but that would be disruptive too.
In that case, the user called Alex won't have right permissions anymore.
So how do we solve this problem
with AC LS or access control lists
to find out what these are and how they help. Let's go through an exercise
first,
let's add some content to file three and we're adding this
as root by the way and just as a reminder,
let's look at the files metadata again,
since our current user is neither Alex
and it doesn't belong to the staff group,
it means that we shouldn't be able to write to the file.
Sure enough. If we try to write to it,
we get the expected result, a permission denied error,
but we should be able to read it.
So cat file three works just fine. Standard file permissions are pretty generic.
They basically apply to one specific user,
one group and all of the other users on the system and that's quite wide.
But AC LS allow us to do the impossible,
define specific permissions for two or more users.
For example, we can use an AC L to allow Jeremy to read and write
Jane to only read and John to be denied all access.
It's also possible to define permissions for multiple groups.
Just like we use the chmod command to change standard file permissions.
We use set F AC L to change advanced permissions defined in AC L.
So let's try it.
And sure enough, we did need to install it.
So to add an AC L entry that allows the
user called Jeremy to read and write to this file,
we'll use the following command.
If we'd want to add all permissions, we'd write colon RWX in that segment
for read and execute. It would be colon Rx and for reed only it would be colon R
since Jeremy now has write permissions.
This command to overwrite the file contents should work
if
great that worked.
But it will work for file two
permission denied.
Even though if we look at the file permissions, they seem to be almost the same.
But if we look closely, there is a slight difference,
AC LS are optional. So most files don't have them.
But one quick way to notice the files that do is this
the little plus sign?
We can notice that there's a plus sign next to the permission bits for file three
that signals that an AC L exists to see the AC L for this file.
We can use the get F AC L command.
We can ignore user group and other as those are just regular permissions of the file.
But we see the AC L entry that we added earlier for Jeremy,
the mask defines the maximum permissions that this file or directory can have.
We don't need to worry about this when we add our AC
LS as the mask will be adjusted automatically to fit our needs.
If we grant RWX permissions for Jeremy,
then the mask will automatically expand to RWX.
But sometimes a mask can be useful if we want to limit existing permissions.
For example, imagine that an AC L specifies four users here.
Some of them can read, write and execute. But maybe we decide that's a bit too much.
The maximum permissions we want to allow is the ability
to read the file but no writing or executing.
But we don't want to waste time manually editing the AC L for every user.
So we can instead define this mask.
Now, if we check the AC L, now
we'll see an interesting new field appearing
effective R
this tells us that even though the AC L says the user,
Jeremy should be able to read and write.
The effective real permissions are read only.
That's because the mask limits permissions here.
Now let's jump to groups
with this command
to remove all AC L entries.
We would use this command.
Sometimes we'll want to apply an AC L to an entire
directory and all the subdirectories and files that may contain.
In
this case,
the technical term is that we want to apply our change recursively and
set F AC L has this option to apply a change recursively.
It's dash dash recursive.
So first let's create this directory
and now let's add an AC L to it recursively.
The dash dash recursive option can also be added
to the commands that remove AC L entries.
So we could type things like this
to remove Jeremy from that directory.
When we turn on an attribute for a file,
it makes it behave in a different way than it would normally
to make this easier to understand.
Let's look at two examples, the append only and the immutable attributes.
Now each attribute has a corresponding letter for a pen only. The letter A is used
only the root user can enable or disable this attribute.
Let's create a new file
to enable the append only attribute on our file. We use the chatter command or CH att R
followed by A plus A.
So what does this change?
Well, with this attribute turned on,
we can only append that is add new data on top of our old data,
we can just keep adding to the file but we cannot overwrite or change old data.
For example, our file currently has this content.
It says this is old content, right?
If we try to overwrite this with new contents, it won't work
the operation, not permitted.
But if we try to add new content without overwriting the old content, it will work.
And now our file looks like this
to remove the append attribute from a file, we just type dash A instead of plus A.
Now let's move to the immutable attribute
represented by the letter I.
Now to set that on a file,
we just change that A to an I.
We do plus I
as the name suggests, this makes the file immutable.
That means it cannot be changed in any way,
it cannot be renamed, deleted or edited.
It's basically frozen. Not even the root user can remove or modify this file.
Look at that.
Now, if we ever find such a file that not even the root user can remove or modify,
we might want to check its attributes and we can do that with the LS att R command.
It's worth mentioning that like the LS command,
the LS
ATTR
command can be used to list an entire directory too.
Now, other attributes can be seen in the user manual.
It's worth mentioning that although many attributes exist,
some of them may have no effect in certain scenarios.
For example, we have the C attribute to enable compression on a file,
but some file systems like EXT four don't support on the fly compression.
So enabling this attribute on a file that exists
on an EXT four file system has no effect
and that's it for this demo.
And I'll see you on the next one.