Hello, and welcome to this presentation from Pluralsight. My name is Andrew
Mallett, and would you believe I'm here as your instructor to help guide you
through the module, the module where we take a look at managing special
permissions? So when you're comfortable, sit with your cup of coffee, ready
with a biscuit. We're going to begin.
The first thing to understand is our file mode exists of special permissions,
user permissions, group permissions, and others.
So far, we've only looked at our standard permissions. In this module though,
we're going to introduce you that elusive fourth block,
the secretive block that nobody talks about. With this, we're
going to be able to start using the sticky bit so we can
control deletions from directories.
We can set the group ID bit on directories, and we can
use that to control ownership of files,
really enhancing our security, so we don't need to worry about permissions
granted to others. And we can also set the user ID bit and group ID bit on
executables to control the execution context, and more on that as we go
through. But not just our permissions, we're also going to dive out a little
bit into Linux capabilities, and we're going to be able to see by using
capabilities, we're able to give exactly the permissions that we need rather
than allowing to run as root.
We don't cover our standard permissions, not in this module. This
was done in managing our file mode and Linux permissions in a
previous module, so please check that out.
We're going to be taking a look at that elusive fourth block where
we actually have 12 bits for our permissions.
We have our user group and others that we've looked at, but
we have that fourth block of three bits.
When we go through and take a look at, let's say, using the
stack command and look at the octal permissions, we can see then
that we have got four octal numbers,
so that bit that is set to 0 at the moment also has 3
bits in it for our user ID bit, group ID bit, and the sticky bit.
When we look at the special permissions,
if the value is set to four then the set user ID bit is configured.
With this, we're setting the execution context, so if anybody runs
the program, they're actually executing as the user owner of that
program. With a set group ID bit,
we can also set this on executable. If we set it on the executable, then
the program executes with the group context of the group owner of the
executable. But on top of that, we can also set it on directories. When we
set the group ID bit on a directory,
any new file created in that directory is going to be group owned by
the owner of the directory. And later on, we'll see some practical use
of that. Finally, where we have 1 set as our value, we have the sticky
bit. With this then, we can control deletions. To be able to write to a
directory, of course,
the user must have the write permission. By having the write permission to a
directory also means they can delete from that directory. Setting the sticky
bit means they can only delete files that they own.
There you go.
That's the elusive fourth block.
When we look at setting those permissions,
we can go ahead and be very clever creating multiple directories in one go.
We'll see this from the command line later,
but we're creating directory one through to directory four.
We can go through on directory one and set the sticky bit, so
this is just controlling the deletions. This would be similar
to the permissions set on /temp.
We can go through and set the group ID bit.
This case is on dir2. This is ensuring all new files
created in the directory are going to be group owned by
the group owner of the directory.
We commonly might combine the two together, giving us 3777.
In this case then, we've got the group ID bit and the sticky
bit set. And we can also have 1770 where we don't have
permissions granted through to others, but we can still set the sticky bit.
We'll see why this is important later when we actually go
through and look at the way the permissions are shown in
the standard symbolic format.
We can go through then and list the permissions, and then it will become
quite clear to us why we wanted to demonstrate this.
We can also use that good friend of ours, the find command, to be able
to search for files with certain permissions set.
If we go through and take a look at, here,
we're looking at type directories where the permissions equals s,
=t, t is for our sticky bitm, we're listing directories where
either the SGID bit or sticky bit is set.
When we can go through and take a look at using ‑=s, o=
t, we're looking where both are set.
If we want to go through and look where the sticky bit is set,
we can just have /o=t.
And if we want to go through and say where the sticky bit
is set and where others have write, we can have o=tw.
Now we did mention demonstrations, didn't we? Come on, we better go out and see this working.