📄 ch22_02.htm
字号:
<HTML><!--Distributed by F --><HEAD><TITLE>[Chapter 22] 22.2 Tutorial on File and Directory Permissions </TITLE><METANAME="DC.title"CONTENT="UNIX Power Tools"><METANAME="DC.creator"CONTENT="Jerry Peek, Tim O'Reilly & Mike Loukides"><METANAME="DC.publisher"CONTENT="O'Reilly & Associates, Inc."><METANAME="DC.date"CONTENT="1998-08-04T21:40:20Z"><METANAME="DC.type"CONTENT="Text.Monograph"><METANAME="DC.format"CONTENT="text/html"SCHEME="MIME"><METANAME="DC.source"CONTENT="1-56592-260-3"SCHEME="ISBN"><METANAME="DC.language"CONTENT="en-US"><METANAME="generator"CONTENT="Jade 1.1/O'Reilly DocBook 3.0 to HTML 4.0"><LINKREV="made"HREF="mailto:online-books@oreilly.com"TITLE="Online Books Comments"><LINKREL="up"HREF="ch22_01.htm"TITLE="22. File Security, Ownership, and Sharing"><LINKREL="prev"HREF="ch22_01.htm"TITLE="22.1 Introduction to File Ownership and Security "><LINKREL="next"HREF="ch22_03.htm"TITLE="22.3 Who Will Own a New File? "></HEAD><BODYBGCOLOR="#FFFFFF"TEXT="#000000"><DIVCLASS="htmlnav"><H1><IMGSRC="gifs/smbanner.gif"ALT="UNIX Power Tools"USEMAP="#srchmap"BORDER="0"></H1><MAPNAME="srchmap"><AREASHAPE="RECT"COORDS="0,0,466,58"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="467,0,514,18"HREF="jobjects/fsearch.htm"ALT="Search this book"></MAP><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_01.htm"TITLE="22.1 Introduction to File Ownership and Security "><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.1 Introduction to File Ownership and Security "BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><B><FONTFACE="ARIEL,HELVETICA,HELV,SANSERIF"SIZE="-1">Chapter 22<BR>File Security, Ownership, and Sharing</FONT></B></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_03.htm"TITLE="22.3 Who Will Own a New File? "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.3 Who Will Own a New File? "BORDER="0"></A></TD></TR></TABLE> <HRALIGN="LEFT"WIDTH="515"TITLE="footer"></DIV><DIVCLASS="SECT1"><H2CLASS="sect1"><ACLASS="title"NAME="UPT-ART-0417">22.2 Tutorial on File and Directory Permissions </A></H2><PCLASS="para">[Think you know all about permissions?Even if you do, skim through this article.Bruce has some good tips. -JP]</P><PCLASS="para"><ACLASS="indexterm"NAME="AUTOID-23757"></A><ACLASS="indexterm"NAME="AUTOID-23760"></A>There are three basic attributes for plain file permissions: read,write, and execute. Read and write permission obviously let you readthe data from a file or write new data to the file. When you haveexecute permission, you can use the file as a program or shell script.The characters used to describe these permissions are <CODECLASS="literal">r</CODE>,<CODECLASS="literal">w</CODE>, and <CODECLASS="literal">x</CODE>, for e<EMCLASS="emphasis">x</EM>ecute.</P><PCLASS="para">Directories use these same permissions, but they have a different meaning.<ACLASS="indexterm"NAME="AUTOID-23769"></A><ACLASS="indexterm"NAME="AUTOID-23771"></A><ACLASS="indexterm"NAME="AUTOID-23773"></A>If a directory has read permission, you can see what files are in the directory.Write permission means you can add, remove, or rename files in the directory.Execute allows you to use the directory name when accessing files inside that directory.(Article<ACLASS="xref"HREF="ch18_02.htm"TITLE="What's Really in a Directory ">18.2</A>has more information about what's in a directory.)Let's examine this more closely.</P><PCLASS="para">Suppose you have read access to a directory,but you do not have execute access to the filesin the directory. You can still read thedirectory, or<SPANCLASS="link"><EMCLASS="emphasis">inode</EM> (<ACLASS="linkend"HREF="ch01_22.htm"TITLE="How UNIX Keeps Track of Files: Inodes ">1.22</A>)</SPAN>information for that file, as returned by the <EMCLASS="emphasis">stat</EM>(2)system call. That is, you can see the file's name, permissions, size, access times, owner and group,and number of links.You cannot read the contents of the file.</P><PCLASS="para">Write permission in a directory allows you to change the contents of a directory.Because the name of the file is stored in the directory, and not the file,<EMCLASS="emphasis">write permission in a directory allows creation, renaming, ordeletion of files</EM>.To be specific, if someone has write permission to your home directory, theycan rename or delete your <EMCLASS="emphasis">.login</EM>file and put a new file in its place.The permissions of your <EMCLASS="emphasis">.login</EM>file do not matter.Someone can rename a file even if they can't read the contents of a file.(See article<ACLASS="xref"HREF="ch22_11.htm"TITLE="A Loophole: Modifying Files Without Write Access">22.11</A>.)</P><PCLASS="para">Execute permission on a directory is sometimes called searchpermission. If you found a directory that gave you executepermission, but not read permission, you could use any file in thatdirectory. However, you <EMCLASS="emphasis">must</EM> know the name. You cannot lookinside the directory to find out the names of the files. Think ofthis type of directory as a black box. You can throw filenames atthis directory, and sometimes you find a file, sometimes you don't.(See article<ACLASS="xref"HREF="ch22_12.htm"TITLE="A Directory that People Can Access but Can't List ">22.12</A>.)</P><DIVCLASS="sect2"><H3CLASS="sect2"><ACLASS="title"NAME="UPT-ART-417-SECT-1.1">22.2.1 User, Group, and World </A></H3><PCLASS="para"><ACLASS="indexterm"NAME="AUTOID-23791"></A><ACLASS="indexterm"NAME="UPT-ART-417-IX-DIRECTORIES-OWNERSHIP"></A><ACLASS="indexterm"NAME="UPT-ART-417-IX-OWNERSHIP-FILE"></A><ACLASS="indexterm"NAME="AUTOID-23800"></A>All files have an owner and group associated with them. There are three sets of read/write/execute permissions: one set for the user or owner of the file,one set for the group <SPANCLASS="link">group (<ACLASS="linkend"HREF="ch22_13.htm"TITLE="Groups and Group Ownership ">22.13</A>)</SPAN>of the file, and one set for everyone else.These permissions are determined by nine bits in theinodeinformation, and are represented by the characters <CODECLASS="literal">rwxrwxrwx</CODE> in an <EMCLASS="emphasis">ls -l</EM> listing:[1]</P><BLOCKQUOTECLASS="footnote"><PCLASS="para">[1] On some UNIX systems, <EMCLASS="emphasis">ls -l</EM> producesan eight-column listing without the group name (here, <CODECLASS="literal">books</CODE>).Use <EMCLASS="emphasis">ls -lg</EM> to get the listing format shown here.</P></BLOCKQUOTE><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">% <CODECLASS="userinput"><B>ls -l</B></CODE>drwxr-xr-x 3 jerry books 512 Feb 14 11:31 manpages-rw-r--r-- 1 jerry books 17233 Dec 10 1990 misc.Z-rwxr-xr-x 1 tim books 195 Mar 29 18:55 myhead</PRE></BLOCKQUOTE></P><PCLASS="para"> The first character in the <EMCLASS="emphasis">ls -l</EM> listing<SPANCLASS="link">specifies the type of file (<ACLASS="linkend"HREF="ch17_13.htm"TITLE="Searching for Files by Type ">17.13</A>)</SPAN>.The first three of the nine permissions characters that follow specify the user, the middle three the group, and the last three the world. If the permission is not true, a dashis used to indicate lack of privilege. If you wanted to have a data file that you could read or write,but don't want anyone else to access, the permissions would be <CODECLASS="literal">rw-------</CODE>.</P><PCLASS="para">An easier way to specify these nine bits is with three octal digits instead of nine characters.(Article<ACLASS="xref"HREF="ch01_23.htm"TITLE="File Access Permissions ">1.23</A>has diagrams of permission bits and explains how to write permissions as anoctal number.)The order is the same, so the above permissions can be describedby the octal number 600.The first number specifies the owner's permission.The second number specifies thepermission.The last number specifies permission to everyone who isnot the owner or not in the group of the file [although permissionsdon't apply to the<SPANCLASS="link">superuser (<ACLASS="linkend"HREF="ch01_24.htm"TITLE="The Superuser (Root) ">1.24</A>)</SPAN>,who can do anything to any file or directory. <EMCLASS="emphasis">-JP</EM> ].</P><PCLASS="para">This last point is subtle. When testing for permissions, thesystem looks at the groups in order. If you are denied permission, UNIX does not examine the next group. Consider the case of a file that is owned by user<EMCLASS="emphasis">jo</EM>,is in the group<EMCLASS="emphasis">guests</EM>,and has the permissions<CODECLASS="literal">-----xrwx</CODE>,or017in octal.This has the result that user<EMCLASS="emphasis">jo</EM>cannot use the file, anyone in group<EMCLASS="emphasis">guests</EM>can execute the program, andeveryone else besides<EMCLASS="emphasis">jo</EM>and <EMCLASS="emphasis">guests</EM>can read, write, and execute the program.This is not a very common set of permissions.But some people use a<SPANCLASS="link">similar mechanism (<ACLASS="linkend"HREF="ch22_14.htm"TITLE="Add Users to a Group to Deny Permission ">22.14</A>)</SPAN>to denyone group of users from accessing or using a file.In the above case, <EMCLASS="emphasis">jo</EM>cannot read or writethe file she owns.She could use the<SPANCLASS="link"><EMCLASS="emphasis">chmod</EM> (<ACLASS="linkend"HREF="ch22_07.htm"TITLE="Using chmod to Change File Permission ">22.7</A>)</SPAN>command to grant herself permission to read the file.However, if the file was in a directory owned by someone else, and the directorydid not give <EMCLASS="emphasis">jo</EM> read or search permission, she would not be able to find the file to change its permission.</P><PCLASS="para">The above example is an extreme case.Most of the time permissions fall into fourcases:</P><OLCLASS="orderedlist"><LICLASS="listitem"><PCLASS="para">The information is personal. Many people have a directory or two in which they store information they do not wish to be public. Mail should probably be confidential, and all of your mailbox files should bein a directory with permissions of 700, denying everyone but yourself and the superuser read access to your letters. (See article<ACLASS="xref"HREF="ch04_05.htm"TITLE="Private (Personal) Directories ">4.5</A>.)</P⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -