And look at this, the end of this module,
a module where we've gone through and taken a look at our special permissions.
Starting off with a sticky bit where we can set this,
we can go o+t, we ensure that users can delete only the
files that they own. With a set group ID bit, we looked at
this first on the directory,
ensuring that new files created within the directory are going to be
group owned by the group owner of the directory.
When we look at the set user ID and set group ID bit set on
executables, they change the execution context. So we can see then
that if we have set the group ID bit on an executable, such as our
write command, it's owned by the tty group, so we'll execute with
permissions granted to the tty group.
And the same thing when we looked at our passwd program that was owned by the
user root, and when we execute it, we're all executing as the root user. To
overcome some of the limitations and vulnerabilities of these SUID and set
group ID programs, we can use Linux capabilities. Adding a capability restricts
the activity to just that allowed by the capability rather than full root
privileges. And that's it.
We're done and dusted with this, but don't think we are done
and dusted with our security just yet.
We can go through and extend the capabilities of what's available to us
with our file mode by adding in access control lists.
So join me in the next module where we'll we'll look at how you
can set access control lists to allow multiple users and multiple groups access to file resources.