📄 ch22_12.htm
字号:
<HTML><!--Distributed by F --><HEAD><TITLE>[Chapter 22] 22.12 A Directory that People Can Access but Can't List </TITLE><METANAME="DC.title"CONTENT="UNIX Power Tools"><METANAME="DC.creator"CONTENT="Jerry Peek, Tim O'Reilly & Mike Loukides"><METANAME="DC.publisher"CONTENT="O'Reilly & Associates, Inc."><METANAME="DC.date"CONTENT="1998-08-04T21:40:32Z"><METANAME="DC.type"CONTENT="Text.Monograph"><METANAME="DC.format"CONTENT="text/html"SCHEME="MIME"><METANAME="DC.source"CONTENT="1-56592-260-3"SCHEME="ISBN"><METANAME="DC.language"CONTENT="en-US"><METANAME="generator"CONTENT="Jade 1.1/O'Reilly DocBook 3.0 to HTML 4.0"><LINKREV="made"HREF="mailto:online-books@oreilly.com"TITLE="Online Books Comments"><LINKREL="up"HREF="ch22_01.htm"TITLE="22. File Security, Ownership, and Sharing"><LINKREL="prev"HREF="ch22_11.htm"TITLE="22.11 A Loophole: Modifying Files Without Write Access"><LINKREL="next"HREF="ch22_13.htm"TITLE="22.13 Groups and Group Ownership "></HEAD><BODYBGCOLOR="#FFFFFF"TEXT="#000000"><DIVCLASS="htmlnav"><H1><IMGSRC="gifs/smbanner.gif"ALT="UNIX Power Tools"USEMAP="#srchmap"BORDER="0"></H1><MAPNAME="srchmap"><AREASHAPE="RECT"COORDS="0,0,466,58"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="467,0,514,18"HREF="jobjects/fsearch.htm"ALT="Search this book"></MAP><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_11.htm"TITLE="22.11 A Loophole: Modifying Files Without Write Access"><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.11 A Loophole: Modifying Files Without Write Access"BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><B><FONTFACE="ARIEL,HELVETICA,HELV,SANSERIF"SIZE="-1">Chapter 22<BR>File Security, Ownership, and Sharing</FONT></B></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_13.htm"TITLE="22.13 Groups and Group Ownership "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.13 Groups and Group Ownership "BORDER="0"></A></TD></TR></TABLE> <HRALIGN="LEFT"WIDTH="515"TITLE="footer"></DIV><DIVCLASS="SECT1"><H2CLASS="sect1"><ACLASS="title"NAME="UPT-ART-3010">22.12 A Directory that People Can Access but Can't List </A></H2><PCLASS="para"><ACLASS="indexterm"NAME="AUTOID-24393"></A><ACLASS="indexterm"NAME="AUTOID-24396"></A>Do you need to let someone use a file of yours, but you don't want everyoneon the system to be able to snoop around in the directory?You can give execute permission, but not read permission, to a directory.Then, if a file in the directory is accessible, a person can usethe file by typing the exact filename.<EMCLASS="emphasis">ls</EM> will say the directory is "unreadable."Wildcards won't work.</P><PCLASS="para">Here's an example.Let's say that your home directory has <CODECLASS="literal">rwxr-xr-x</CODE> permissions (everyone canaccess and list files in it).Your username is <EMCLASS="emphasis">hanna</EM>.You have a subdirectory named <EMCLASS="emphasis">project</EM>; you setits permissions so thateveryone else on the system has execute-only permission.</P><PCLASS="para"><TABLECLASS="screen.co"BORDER="1"><TR><THVALIGN="TOP"><PRECLASS="calloutlist"> <ACLASS="co"HREF="ch16_08.htm"TITLE="16.8 The ls -d Option ">-d</A> </PRE></TH><TDVALIGN="TOP"><PRECLASS="screen">hanna% <CODECLASS="userinput"><B>pwd</B></CODE>/home/hannahanna% <CODECLASS="userinput"><B>chmod 711 project</B></CODE>hanna% <CODECLASS="userinput"><B>ls -ld project project/myplan</B></CODE>drwx--x--x 2 hanna 512 Jul 26 12:14 project-rw-r--r-- 1 hanna 9284 Jul 27 17:34 project/myplan</PRE></TD></TR></TABLE></P><PCLASS="para">Now you tell the other user, <EMCLASS="emphasis">toria</EM>, the exact name of your file,<EMCLASS="emphasis">myplan</EM>.Like everyone else on the system, she can access your <EMCLASS="emphasis">project</EM> directory.She can't list it because she doesn't have read permission.Because she knows the exact filename, she can read the file because the fileis readable(anyone else could read the file, too, if they knew its exact name):</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">toria% <CODECLASS="userinput"><B>cd /home/hanna/project</B></CODE>toria% <CODECLASS="userinput"><B>pwd</B></CODE>pwd: can't read .toria% <CODECLASS="userinput"><B>ls</B></CODE>ls: . unreadabletoria% <CODECLASS="userinput"><B>more myplan</B></CODE> ...<EMCLASS="emphasis">File appears</EM>...toria% <CODECLASS="userinput"><B>ln myplan /home/toria/project.hanna/plan</B></CODE></PRE></BLOCKQUOTE></P><PCLASS="para">(We're using the "real" <EMCLASS="emphasis">pwd</EM> commandthat reads the filesystem to find your current directory.That's why it complains <CODECLASS="literal">can't read .</CODE>.If you're using the shell's shortcut <EMCLASS="emphasis">pwd</EM>, you probably won'tget the error shown above.Article<ACLASS="xref"HREF="ch14_04.htm"TITLE="How Does UNIX Find Your Current Directory? ">14.4</A>has details.)</P><PCLASS="para">In the example above, <EMCLASS="emphasis">toria</EM> made a<SPANCLASS="link">hard link (<ACLASS="linkend"HREF="ch18_05.htm"TITLE="Creating and Removing Links ">18.5</A>)</SPAN>to the <EMCLASS="emphasis">myplan</EM> file, with a different name, in herown <EMCLASS="emphasis">project.hanna</EM> directory.(She could have copied, printed, or used any other command that reads the file.)Now, if you (<EMCLASS="emphasis">hanna</EM>) want to, you can deny everyone's permission to your<EMCLASS="emphasis">project</EM> directory.<EMCLASS="emphasis">toria</EM> still has her link to the file, though.She can read it any time she wants to, follow the changes you make to it, andso on:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">toria% <CODECLASS="userinput"><B>cd</B></CODE>toria% <CODECLASS="userinput"><B>ls -ld project.hanna project.hanna/plan</B></CODE>drwx------ 2 toria 512 Jul 27 16:43 project.hanna-rw-r--r-- 2 hanna 9284 Jul 27 17:34 project.hanna/plantoria% <CODECLASS="userinput"><B>more project.hanna/plan</B></CODE> ...<EMCLASS="emphasis">File appears</EM>...</PRE></BLOCKQUOTE></P><PCLASS="para"><EMCLASS="emphasis">toria</EM> has protected her <EMCLASS="emphasis">project.hanna</EM> directory so that otherusers can't find her link to <EMCLASS="emphasis">hanna</EM>'s file.</P><BLOCKQUOTECLASS="note"><PCLASS="para"><STRONG>NOTE:</STRONG> If <EMCLASS="emphasis">hanna</EM> denies permission to her directory, <EMCLASS="emphasis">toria</EM> can still readthe file through her hard link.If <EMCLASS="emphasis">toria</EM> had made a symbolic link, though, she wouldn't be able toaccess the file any more.That's because<SPANCLASS="link">a hard link keeps the file's i-number (<ACLASS="linkend"HREF="ch01_22.htm"TITLE="How UNIX Keeps Track of Files: Inodes ">1.22</A>, <ACLASS="linkend"HREF="ch18_02.htm"TITLE="What's Really in a Directory ">18.2</A>)</SPAN>but a symbolic linkdoesn't.</P></BLOCKQUOTE><PCLASS="para">You might also want to give other users permission to list and access thefiles in a directory, but not make the directory open to all users.One way to do this is to put a fully accessible directory with an unusualname inside an unreadable directory.Users who know the exact name of the fully accessible directory can <EMCLASS="emphasis">cd</EM>to it; other users can't find it without its name:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">hanna% <CODECLASS="userinput"><B>chmod 711 project</B></CODE>hanna% <CODECLASS="userinput"><B>chmod 777 project/pLaN</B></CODE>hanna% <CODECLASS="userinput"><B>ls -ld project project/pLaN</B></CODE>drwx--x--x 3 hanna 512 Jul 27 17:36 projectdrwxrwxrwx 2 hanna 512 Jul 27 17:37 project/pLaN</PRE></BLOCKQUOTE></P><PCLASS="para">Users who type <CODECLASS="literal">cd /home/hanna/project/pLaN</CODE> can list the directory'scontents with <EMCLASS="emphasis">ls</EM>.With the permissions you've set, other users can also create, delete, andrename files inside the <EMCLASS="emphasis">pLaN</EM> directory - though you could have usedmore restrictive permissions like <CODECLASS="literal">drwxr-xr-x</CODE> instead.</P><PCLASS="para">This setup can still be a little confusing.For instance,as article<ACLASS="xref"HREF="ch14_04.htm"TITLE="How Does UNIX Find Your Current Directory? ">14.4</A>explains,the <EMCLASS="emphasis">pwd</EM> command won't work for users in the <EMCLASS="emphasis">pLaN</EM>directory because <EMCLASS="emphasis">pwd</EM> can't read the <EMCLASS="emphasis">project</EM> directory.Variables like<SPANCLASS="link"><CODECLASS="literal">$cwd</CODE> (<ACLASS="linkend"HREF="ch14_13.htm"TITLE="Which Directory Am I in, Really? ">14.13</A>)</SPAN>and<SPANCLASS="link"><CODECLASS="literal">$PWD</CODE> (<ACLASS="linkend"HREF="ch06_03.htm"TITLE="Predefined Environment Variables ">6.3</A>)</SPAN>will probably have the absolutepathname.If another user gets lost in a restricted directory like this, the best thingto do is <EMCLASS="emphasis">cd</EM> to the home directory and start again.</P><DIVCLASS="sect1info"><PCLASS="SECT1INFO">- <SPANCLASS="authorinitials">JP</SPAN></P></DIV></DIV><DIVCLASS="htmlnav"><P></P><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_11.htm"TITLE="22.11 A Loophole: Modifying Files Without Write Access"><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.11 A Loophole: Modifying Files Without Write Access"BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="book"HREF="index.htm"TITLE="UNIX Power Tools"><IMGSRC="gifs/txthome.gif"SRC="gifs/txthome.gif"ALT="UNIX Power Tools"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_13.htm"TITLE="22.13 Groups and Group Ownership "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.13 Groups and Group Ownership "BORDER="0"></A></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172">22.11 A Loophole: Modifying Files Without Write Access</TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="index"HREF="index/idx_0.htm"TITLE="Book Index"><IMGSRC="gifs/index.gif"SRC="gifs/index.gif"ALT="Book Index"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172">22.13 Groups and Group Ownership </TD></TR></TABLE><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><IMGSRC="gifs/smnavbar.gif"SRC="gifs/smnavbar.gif"USEMAP="#map"BORDER="0"ALT="The UNIX CD Bookshelf Navigation"><MAPNAME="map"><AREASHAPE="RECT"COORDS="0,0,73,21"HREF="../index.htm"ALT="The UNIX CD Bookshelf"><AREASHAPE="RECT"COORDS="74,0,163,21"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="164,0,257,21"HREF="../unixnut/index.htm"ALT="UNIX in a Nutshell"><AREASHAPE="RECT"COORDS="258,0,321,21"HREF="../vi/index.htm"ALT="Learning the vi Editor"><AREASHAPE="RECT"COORDS="322,0,378,21"HREF="../sedawk/index.htm"ALT="sed & awk"><AREASHAPE="RECT"COORDS="379,0,438,21"HREF="../ksh/index.htm"ALT="Learning the Korn Shell"><AREASHAPE="RECT"COORDS="439,0,514,21"HREF="../lrnunix/index.htm"ALT="Learning the UNIX Operating System"></MAP></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -