📄 ch22_14.htm
字号:
<HTML><!--Distributed by F --><HEAD><TITLE>[Chapter 22] 22.14 Add Users to a Group to Deny Permission </TITLE><METANAME="DC.title"CONTENT="UNIX Power Tools"><METANAME="DC.creator"CONTENT="Jerry Peek, Tim O'Reilly & Mike Loukides"><METANAME="DC.publisher"CONTENT="O'Reilly & Associates, Inc."><METANAME="DC.date"CONTENT="1998-08-04T21:40:35Z"><METANAME="DC.type"CONTENT="Text.Monograph"><METANAME="DC.format"CONTENT="text/html"SCHEME="MIME"><METANAME="DC.source"CONTENT="1-56592-260-3"SCHEME="ISBN"><METANAME="DC.language"CONTENT="en-US"><METANAME="generator"CONTENT="Jade 1.1/O'Reilly DocBook 3.0 to HTML 4.0"><LINKREV="made"HREF="mailto:online-books@oreilly.com"TITLE="Online Books Comments"><LINKREL="up"HREF="ch22_01.htm"TITLE="22. File Security, Ownership, and Sharing"><LINKREL="prev"HREF="ch22_13.htm"TITLE="22.13 Groups and Group Ownership "><LINKREL="next"HREF="ch22_15.htm"TITLE="22.15 Juggling Permissions "></HEAD><BODYBGCOLOR="#FFFFFF"TEXT="#000000"><DIVCLASS="htmlnav"><H1><IMGSRC="gifs/smbanner.gif"ALT="UNIX Power Tools"USEMAP="#srchmap"BORDER="0"></H1><MAPNAME="srchmap"><AREASHAPE="RECT"COORDS="0,0,466,58"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="467,0,514,18"HREF="jobjects/fsearch.htm"ALT="Search this book"></MAP><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_13.htm"TITLE="22.13 Groups and Group Ownership "><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.13 Groups and Group Ownership "BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><B><FONTFACE="ARIEL,HELVETICA,HELV,SANSERIF"SIZE="-1">Chapter 22<BR>File Security, Ownership, and Sharing</FONT></B></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_15.htm"TITLE="22.15 Juggling Permissions "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.15 Juggling Permissions "BORDER="0"></A></TD></TR></TABLE> <HRALIGN="LEFT"WIDTH="515"TITLE="footer"></DIV><DIVCLASS="SECT1"><H2CLASS="sect1"><ACLASS="title"NAME="UPT-ART-0295">22.14 Add Users to a Group to Deny Permission </A></H2><PCLASS="para"><ACLASS="indexterm"NAME="AUTOID-24551"></A><ACLASS="indexterm"NAME="AUTOID-24554"></A>Usually, UNIX<SPANCLASS="link">group access (<ACLASS="linkend"HREF="ch22_13.htm"TITLE="Groups and Group Ownership ">22.13</A>)</SPAN>allows a group of users to access a directory or file that they couldn'totherwise access.You can turn this around, though, with groups that <EMCLASS="emphasis">deny</EM> permission.</P><BLOCKQUOTECLASS="note"><PCLASS="para"><STRONG>NOTE:</STRONG> This trick works only on UNIX systems, like BSD, that let a user belong tomore than one group at the same time.</P></BLOCKQUOTE><PCLASS="para">For example, you might work on a computer that has some proprietaryfiles and software that three "guest" accounts shouldn't be able to use.Everyone else on the computer should have access.To do this, put the software in a directory owned by a group namedsomething like <EMCLASS="emphasis">deny</EM>.Then use <EMCLASS="emphasis">chmod</EM> to deny permission to that group:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen"># <CODECLASS="userinput"><B>chmod 705 /usr/local/somedir</B></CODE># <CODECLASS="userinput"><B>ls -lgd /usr/local/somedir</B></CODE>drwx--r-x 2 root deny 512 Mar 26 12:14 /usr/local/somedir</PRE></BLOCKQUOTE></P><PCLASS="para">Finally, add the guest accounts to the <EMCLASS="emphasis">deny</EM> group (in the<EMCLASS="emphasis">/etc/group</EM> file).</P><PCLASS="para">UNIX checks permissions in the order <EMCLASS="emphasis">user</EM>-<EMCLASS="emphasis">group</EM>-<EMCLASS="emphasis">other</EM>.The first applicable permission is the one used, even if it deniespermission rather than grant it.In this case, none of the guest accounts are <EMCLASS="emphasis">root</EM> (we hope! <CODECLASS="literal">:-)</CODE>).They're members of the group called <EMCLASS="emphasis">deny</EM>, however - so that permission(<CODECLASS="literal">---</CODE>) is checked and the group members are shut out.Other users who aren't members of <EMCLASS="emphasis">deny</EM> are checked for"other" access (<CODECLASS="literal">r-x</CODE>); they can get into the directory.</P><PCLASS="para">The same setup works for individual files (like programs).Just be careful about changing system programs that are<SPANCLASS="link">SUID or SGID (<ACLASS="linkend"HREF="ch01_23.htm"TITLE="File Access Permissions ">1.23</A>)</SPAN>.</P><DIVCLASS="sect1info"><PCLASS="SECT1INFO">- <SPANCLASS="authorinitials">JP</SPAN>, <SPANCLASS="authorinitials">JIK</SPAN></P></DIV></DIV><DIVCLASS="htmlnav"><P></P><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_13.htm"TITLE="22.13 Groups and Group Ownership "><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.13 Groups and Group Ownership "BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="book"HREF="index.htm"TITLE="UNIX Power Tools"><IMGSRC="gifs/txthome.gif"SRC="gifs/txthome.gif"ALT="UNIX Power Tools"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_15.htm"TITLE="22.15 Juggling Permissions "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.15 Juggling Permissions "BORDER="0"></A></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172">22.13 Groups and Group Ownership </TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="index"HREF="index/idx_0.htm"TITLE="Book Index"><IMGSRC="gifs/index.gif"SRC="gifs/index.gif"ALT="Book Index"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172">22.15 Juggling Permissions </TD></TR></TABLE><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><IMGSRC="gifs/smnavbar.gif"SRC="gifs/smnavbar.gif"USEMAP="#map"BORDER="0"ALT="The UNIX CD Bookshelf Navigation"><MAPNAME="map"><AREASHAPE="RECT"COORDS="0,0,73,21"HREF="../index.htm"ALT="The UNIX CD Bookshelf"><AREASHAPE="RECT"COORDS="74,0,163,21"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="164,0,257,21"HREF="../unixnut/index.htm"ALT="UNIX in a Nutshell"><AREASHAPE="RECT"COORDS="258,0,321,21"HREF="../vi/index.htm"ALT="Learning the vi Editor"><AREASHAPE="RECT"COORDS="322,0,378,21"HREF="../sedawk/index.htm"ALT="sed & awk"><AREASHAPE="RECT"COORDS="379,0,438,21"HREF="../ksh/index.htm"ALT="Learning the Korn Shell"><AREASHAPE="RECT"COORDS="439,0,514,21"HREF="../lrnunix/index.htm"ALT="Learning the UNIX Operating System"></MAP></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -