📄 ch22_15.htm
字号:
<HTML><!--Distributed by F --><HEAD><TITLE>[Chapter 22] 22.15 Juggling Permissions </TITLE><METANAME="DC.title"CONTENT="UNIX Power Tools"><METANAME="DC.creator"CONTENT="Jerry Peek, Tim O'Reilly & Mike Loukides"><METANAME="DC.publisher"CONTENT="O'Reilly & Associates, Inc."><METANAME="DC.date"CONTENT="1998-08-04T21:40:36Z"><METANAME="DC.type"CONTENT="Text.Monograph"><METANAME="DC.format"CONTENT="text/html"SCHEME="MIME"><METANAME="DC.source"CONTENT="1-56592-260-3"SCHEME="ISBN"><METANAME="DC.language"CONTENT="en-US"><METANAME="generator"CONTENT="Jade 1.1/O'Reilly DocBook 3.0 to HTML 4.0"><LINKREV="made"HREF="mailto:online-books@oreilly.com"TITLE="Online Books Comments"><LINKREL="up"HREF="ch22_01.htm"TITLE="22. File Security, Ownership, and Sharing"><LINKREL="prev"HREF="ch22_14.htm"TITLE="22.14 Add Users to a Group to Deny Permission "><LINKREL="next"HREF="ch22_16.htm"TITLE="22.16 Copying Permissions with cpmod "></HEAD><BODYBGCOLOR="#FFFFFF"TEXT="#000000"><DIVCLASS="htmlnav"><H1><IMGSRC="gifs/smbanner.gif"ALT="UNIX Power Tools"USEMAP="#srchmap"BORDER="0"></H1><MAPNAME="srchmap"><AREASHAPE="RECT"COORDS="0,0,466,58"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="467,0,514,18"HREF="jobjects/fsearch.htm"ALT="Search this book"></MAP><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_14.htm"TITLE="22.14 Add Users to a Group to Deny Permission "><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.14 Add Users to a Group to Deny Permission "BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><B><FONTFACE="ARIEL,HELVETICA,HELV,SANSERIF"SIZE="-1">Chapter 22<BR>File Security, Ownership, and Sharing</FONT></B></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_16.htm"TITLE="22.16 Copying Permissions with cpmod "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.16 Copying Permissions with cpmod "BORDER="0"></A></TD></TR></TABLE> <HRALIGN="LEFT"WIDTH="515"TITLE="footer"></DIV><DIVCLASS="SECT1"><H2CLASS="sect1"><ACLASS="title"NAME="UPT-ART-9004">22.15 Juggling Permissions </A></H2><PCLASS="para"><ACLASS="indexterm"NAME="AUTOID-24589"></A>Like any security feature, UNIX permissions occasionally get in your way.When you want to let people use your apartment, you have to makesure you can get them a key; and when you want to let someone into your files, you have to make sure they have read and write access.</P><PCLASS="para">In the ideal world,each file would have a list of users who can access it, and the file's owner could just add or delete users from that list at will.Some secure versions of UNIX are configured this way,but standard UNIX systems don't provide that degree of control.Instead, we have to know how to juggle UNIX filepermissions to achieve our ends.</P><PCLASS="para">For example, suppose I have a file called <EMCLASS="emphasis">ch01</EM> thatI want edited by another user, <EMCLASS="emphasis">val</EM>.I tell her that thefile is <EMCLASS="emphasis">/books/ptools/ch01</EM>, but she reports to me that she can't access it.</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">val % <CODECLASS="userinput"><B>cd /books/ptools</B></CODE>val % <CODECLASS="userinput"><B>more ch01</B></CODE>ch01: Permission denied</PRE></BLOCKQUOTE></P><PCLASS="para">The reason <EMCLASS="emphasis">val</EM> can't read the file is that it is setto be readable only by me.<EMCLASS="emphasis">val</EM> can check the permissions on the file using the<EMCLASS="emphasis">-l</EM> option to the <EMCLASS="emphasis">ls</EM> command:<ACLASS="indexterm"NAME="AUTOID-24606"></A></P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">val % <CODECLASS="userinput"><B>ls -l ch01</B></CODE>-rw------- 1 lmui 13727 Sep 21 07:43 ch01</PRE></BLOCKQUOTE></P><PCLASS="para"><EMCLASS="emphasis">val</EM> asks me (<EMCLASS="emphasis">lmui</EM>) to give her read and writepermission on the file.Only the file owner and <EMCLASS="emphasis">root</EM> canchange permission for a file. Now, what's the best way to give <EMCLASS="emphasis">val</EM> access to <EMCLASS="emphasis">ch01</EM>?</P><PCLASS="para">The fastest and most sure-fire way to give another user permissionis to extend read and write permission to everyone:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">lmui % <CODECLASS="userinput"><B>chmod 666 ch01</B></CODE>lmui % <CODECLASS="userinput"><B>ls -l ch01</B></CODE>-rw-rw-rw- 1 lmui 13727 Sep 21 07:43 ch01</PRE></BLOCKQUOTE></P><PCLASS="para">But this is sort of like leaving your front door wide open so your cat can get in and out.It's far better to extend read and write access to acommon group instead of to the entire world.I try to give <EMCLASS="emphasis">val</EM>access to the file by giving group read and write access:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">lmui % <CODECLASS="userinput"><B>chmod 660 ch01</B></CODE>lmui % <CODECLASS="userinput"><B>ls -l ch01</B></CODE>-rw-rw---- 1 lmui 13727 Sep 21 07:43 ch01</PRE></BLOCKQUOTE></P><PCLASS="para">But <EMCLASS="emphasis">val</EM> reports that it still doesn't work:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">val % <CODECLASS="userinput"><B>more ch01</B></CODE>ch01: Permission denied</PRE></BLOCKQUOTE></P><PCLASS="para">What happened?Well, I gave read and write permission to the file's group, but <EMCLASS="emphasis">val</EM> doesn't belong to that group.You can find out the group a filebelongs to using the <EMCLASS="emphasis">-lg</EM> option to <EMCLASS="emphasis">ls</EM>(this is the default on System V when you type <CODECLASS="literal">ls -l</CODE>):</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">val % <CODECLASS="userinput"><B>ls -lg ch01</B></CODE>-rw-rw---- 1 lmui power 13727 Sep 21 07:43 ch01</PRE></BLOCKQUOTE></P><TABLECLASS="para.programreference"BORDER="1"><TR><THVALIGN="TOP"><ACLASS="programreference"HREF="examples/index.htm"TITLE="groups">groups</A><BR></TH><TDVALIGN="TOP"><ACLASS="indexterm"NAME="AUTOID-24644"></A>You can use the <EMCLASS="emphasis">groups</EM> command(the GNU version is on the CD-ROM)to find out what groups a user belongs to:</TD></TR></TABLE><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">% <CODECLASS="userinput"><B>groups val</B></CODE>val : authors ora% <CODECLASS="userinput"><B>groups lmui</B></CODE>lmui : authors power wheel ora</PRE></BLOCKQUOTE></P><PCLASS="para">The <EMCLASS="emphasis">ch01</EM> file belongs to group <EMCLASS="emphasis">power</EM>.<EMCLASS="emphasis">val</EM> isn't a member of this group, butboth <EMCLASS="emphasis">lmui</EM> and <EMCLASS="emphasis">val</EM> are in the <EMCLASS="emphasis">authors</EM> group. To give <EMCLASS="emphasis">val</EM> access to the file <EMCLASS="emphasis">ch01</EM>, therefore,I need to put the file in group <EMCLASS="emphasis">authors</EM>.To do that,I use the <SPANCLASS="link"><EMCLASS="emphasis">chgrp</EM> (<ACLASS="linkend"HREF="ch01_23.htm"TITLE="File Access Permissions ">1.23</A>)</SPAN>command:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">lmui % <CODECLASS="userinput"><B>chgrp authors ch01</B></CODE>lmui % <CODECLASS="userinput"><B>ls -lg ch01</B></CODE>-rw-rw---- 1 lmui authors 13727 Sep 21 07:43 ch01</PRE></BLOCKQUOTE></P><PCLASS="para">Now <EMCLASS="emphasis">val</EM> can read and write the file.(OnSystem V systems, she may need to run <SPANCLASS="link"><EMCLASS="emphasis">newgrp</EM> (<ACLASS="linkend"HREF="ch22_13.htm"TITLE="Groups and Group Ownership ">22.13</A>)</SPAN>first.)</P><DIVCLASS="sect1info"><PCLASS="SECT1INFO">- <SPANCLASS="authorinitials">LM</SPAN></P></DIV></DIV><DIVCLASS="htmlnav"><P></P><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_14.htm"TITLE="22.14 Add Users to a Group to Deny Permission "><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.14 Add Users to a Group to Deny Permission "BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="book"HREF="index.htm"TITLE="UNIX Power Tools"><IMGSRC="gifs/txthome.gif"SRC="gifs/txthome.gif"ALT="UNIX Power Tools"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_16.htm"TITLE="22.16 Copying Permissions with cpmod "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.16 Copying Permissions with cpmod "BORDER="0"></A></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172">22.14 Add Users to a Group to Deny Permission </TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="index"HREF="index/idx_0.htm"TITLE="Book Index"><IMGSRC="gifs/index.gif"SRC="gifs/index.gif"ALT="Book Index"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172">22.16 Copying Permissions with cpmod </TD></TR></TABLE><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><IMGSRC="gifs/smnavbar.gif"SRC="gifs/smnavbar.gif"USEMAP="#map"BORDER="0"ALT="The UNIX CD Bookshelf Navigation"><MAPNAME="map"><AREASHAPE="RECT"COORDS="0,0,73,21"HREF="../index.htm"ALT="The UNIX CD Bookshelf"><AREASHAPE="RECT"COORDS="74,0,163,21"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="164,0,257,21"HREF="../unixnut/index.htm"ALT="UNIX in a Nutshell"><AREASHAPE="RECT"COORDS="258,0,321,21"HREF="../vi/index.htm"ALT="Learning the vi Editor"><AREASHAPE="RECT"COORDS="322,0,378,21"HREF="../sedawk/index.htm"ALT="sed & awk"><AREASHAPE="RECT"COORDS="379,0,438,21"HREF="../ksh/index.htm"ALT="Learning the Korn Shell"><AREASHAPE="RECT"COORDS="439,0,514,21"HREF="../lrnunix/index.htm"ALT="Learning the UNIX Operating System"></MAP></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -