When we take a look at a directory,
the minimum permissions for a directory is the execute bit.
A lot of people think it's read and execute, but we only need the
execute. The execute permission allows the user to enter the
directory, but without having the read permission, we're unable to
list the contents of the directory.
But then so long as our users know the name of the file to which they need to
have access and they have the read permissions to those files,
they're going to be able to access them.
So come on,
why don't we dive out to our command line and take a look at why assigning
the minimum permissions is way better than assigning maximum permissions?
We can create a directory assigning just the execute permission and then
test and diagnose our user issues.
So here we are back at our command line, and let's take a look
at how we can go through and control access,
making sure that we only provide the minimum access requirements.
So let's go through then and create a directory. With sudo and mkdir,
you might have come across the ‑m where we can set the mode.
I'm going to set the mode to 701.
We're giving read, write, and execute permissions through to the user owner.
We don't really need to assign any permissions to the group, and we're
assigning just the execute permission through to others, and we can do
that maybe for the shared directory.
If we go through and just take a look at this, so doing our ls ‑ld, on then
that last argument, we can go through and see that we have set then with
just the execute permission. As an ordinary user,
I will be accessing through others.
I'm not the root user.
I don't belong to the root group, so I will pick up
permissions granted through to others.
If I see that I can enter the directory, so /shared,
I'm able to access the directory.
But if I try and list the directory,
this is where we're then invoking the read privilege, and
I don't have the read privilege through to this directory,
so I'm unable to list it.
But if we have content, and let's go through and do something like a
sudo and vim /shared and then file1, if we go through and put in some
content, let's just keep it really short.
So long as I know the name, obviously, as we said, we can't list it, but so long
as I've got the read permission through to that file, let's go through now and
cat file1, I'm going to be able to read that file.
I can't list it, but so long as I know the name of that file, I can
access it, and then it becomes very easy to share out files, give
people the name of that file or even web servers.
When you access it through the web server, the web server is
obviously following a link, so it's knowing the name of the
file that you're trying to access.
But we can see just having the execute permission
denies me from listing the directory, but so long as I know the name of the file, I can access it.